73307a7d8b074412bb22d92347e8195bf50667e4bc1ceec9ee0fe8333f1400f1

Analysis

max time kernel
42s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:28

Target

73307a7d8b074412bb22d92347e8195bf50667e4bc1ceec9ee0fe8333f1400f1.exe
Size

216KB
MD5

4500d779875a36b4893bbe91be04f610
SHA1

a56e4395ff7ab3a70bb8d8551c99db7f5a02ac25
SHA256

73307a7d8b074412bb22d92347e8195bf50667e4bc1ceec9ee0fe8333f1400f1
SHA512

ee1859c5f23d92c20d656ac86a097c06f38a75157735632d4cebf80232611f9148fbd45bd47b43766f349b60f8c024ea434659cbffb53906ee2e9ece6c09dc0f
SSDEEP

3072:TrYgJesJikvyxyvZcMO/6T4nIB5BAZlB/PGm7PT+CMU1sdD3E+NziGE:Tp5J9qAZcR/6TkINwlBf+l2sdD3jzij

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1128	2016	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1128	2016	73307a7d8b074412bb22d92347e8195bf50667e4bc1ceec9ee0fe8333f1400f1.exe	26
PID 2016 wrote to memory of 1128	2016	73307a7d8b074412bb22d92347e8195bf50667e4bc1ceec9ee0fe8333f1400f1.exe	26
PID 2016 wrote to memory of 1128	2016	73307a7d8b074412bb22d92347e8195bf50667e4bc1ceec9ee0fe8333f1400f1.exe	26
PID 2016 wrote to memory of 1128	2016	73307a7d8b074412bb22d92347e8195bf50667e4bc1ceec9ee0fe8333f1400f1.exe	26

C:\Users\Admin\AppData\Local\Temp\73307a7d8b074412bb22d92347e8195bf50667e4bc1ceec9ee0fe8333f1400f1.exe
"C:\Users\Admin\AppData\Local\Temp\73307a7d8b074412bb22d92347e8195bf50667e4bc1ceec9ee0fe8333f1400f1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 136
  2⤵
  - Program crash
  PID:1128

memory/2016-54-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download
memory/2016-56-0x0000000001000000-0x0000000001032000-memory.dmp

Filesize
200KB

Download