942128075f141164aea2643a26195b326142589efb6513169fa6971042d12bdf

Analysis

max time kernel
17s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 00:34

Target

942128075f141164aea2643a26195b326142589efb6513169fa6971042d12bdf.exe
Size

221KB
MD5

3455b8197262d06d3c602feb6a5fdabe
SHA1

7add76cdb9bfd00743b9b451a5aa4f70f0cbea4d
SHA256

942128075f141164aea2643a26195b326142589efb6513169fa6971042d12bdf
SHA512

124fbdaa6f4251de2414b1eaa08729a30358202fba9d312e08a323b306cdb7453cda39147d146b7709ae19d48f2c564f16d7a701990f607a24093c6c160e31a0
SSDEEP

6144:wy3FHCRaOOUl7jihKlJZq15Qkq7jNkJaAeX:pFHCDvSKl+UkeqaAg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
968	1728	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 968	1728	942128075f141164aea2643a26195b326142589efb6513169fa6971042d12bdf.exe	28
PID 1728 wrote to memory of 968	1728	942128075f141164aea2643a26195b326142589efb6513169fa6971042d12bdf.exe	28
PID 1728 wrote to memory of 968	1728	942128075f141164aea2643a26195b326142589efb6513169fa6971042d12bdf.exe	28
PID 1728 wrote to memory of 968	1728	942128075f141164aea2643a26195b326142589efb6513169fa6971042d12bdf.exe	28

C:\Users\Admin\AppData\Local\Temp\942128075f141164aea2643a26195b326142589efb6513169fa6971042d12bdf.exe
"C:\Users\Admin\AppData\Local\Temp\942128075f141164aea2643a26195b326142589efb6513169fa6971042d12bdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 96
  2⤵
  - Program crash
  PID:968

memory/1728-55-0x0000000001040000-0x0000000001052000-memory.dmp

Filesize
72KB

Download