947efaae862ff1c16c1dde54974893fec92f1a39ff38e1485e56eed8c114fefb

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 12:02

Target

947efaae862ff1c16c1dde54974893fec92f1a39ff38e1485e56eed8c114fefb.exe
Size

160KB
MD5

22dffa8891412fb8b92fb8f409cda120
SHA1

f73873cadd3c71ffc00caec7ff1818e3b9410c04
SHA256

947efaae862ff1c16c1dde54974893fec92f1a39ff38e1485e56eed8c114fefb
SHA512

d6b84bf9c7ddfe366ae0498b06cf625e8bbc1d58f40a533a700ee1a6238b18bb066ac91bbc604631ea8607663fc8b218401ee40b3470ca4707f12a18624bde00
SSDEEP

1536:oCCBwx4858KwaJHqnzUkcmvMTFCEYl0XIwSY+A37feaCMJDmYsLIb4PvYqHB/AgL:oDwi858PaJqnzFc/pSDADeak7dJHB/Ao

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1272	1740	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 1272	1740	947efaae862ff1c16c1dde54974893fec92f1a39ff38e1485e56eed8c114fefb.exe	27
PID 1740 wrote to memory of 1272	1740	947efaae862ff1c16c1dde54974893fec92f1a39ff38e1485e56eed8c114fefb.exe	27
PID 1740 wrote to memory of 1272	1740	947efaae862ff1c16c1dde54974893fec92f1a39ff38e1485e56eed8c114fefb.exe	27
PID 1740 wrote to memory of 1272	1740	947efaae862ff1c16c1dde54974893fec92f1a39ff38e1485e56eed8c114fefb.exe	27

C:\Users\Admin\AppData\Local\Temp\947efaae862ff1c16c1dde54974893fec92f1a39ff38e1485e56eed8c114fefb.exe
"C:\Users\Admin\AppData\Local\Temp\947efaae862ff1c16c1dde54974893fec92f1a39ff38e1485e56eed8c114fefb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 144
  2⤵
  - Program crash
  PID:1272

memory/1740-55-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download