fca4c1556235f1c6d607351b0d29f0b60c48121dc057687db2bad47c34c02f2e

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 01:21

Target

fca4c1556235f1c6d607351b0d29f0b60c48121dc057687db2bad47c34c02f2e.exe
Size

79KB
MD5

58fd25534d6929d9b8b8f05e5f377bee
SHA1

15a69a8634192c26c0df92b5fb475aff9aad7a3f
SHA256

fca4c1556235f1c6d607351b0d29f0b60c48121dc057687db2bad47c34c02f2e
SHA512

4fd6d8a5137239daf42f2c58938152f0400f3ca95e2b2432e13bb636a7490dd2fc7a3c97f4d9693026579ee5edf27bce626f056ddebe4db2bf73b100f03663d6
SSDEEP

1536:p3aPz4TcV5C09M46W4hVB/VAzt+7zfzmDSf4+oKm+H32JafyE0ws0Y:p3aPz4TcVtMR+k7zf0+oKm43uaJNY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1504	748	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 1504	748	fca4c1556235f1c6d607351b0d29f0b60c48121dc057687db2bad47c34c02f2e.exe	28
PID 748 wrote to memory of 1504	748	fca4c1556235f1c6d607351b0d29f0b60c48121dc057687db2bad47c34c02f2e.exe	28
PID 748 wrote to memory of 1504	748	fca4c1556235f1c6d607351b0d29f0b60c48121dc057687db2bad47c34c02f2e.exe	28
PID 748 wrote to memory of 1504	748	fca4c1556235f1c6d607351b0d29f0b60c48121dc057687db2bad47c34c02f2e.exe	28

C:\Users\Admin\AppData\Local\Temp\fca4c1556235f1c6d607351b0d29f0b60c48121dc057687db2bad47c34c02f2e.exe
"C:\Users\Admin\AppData\Local\Temp\fca4c1556235f1c6d607351b0d29f0b60c48121dc057687db2bad47c34c02f2e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 140
  2⤵
  - Program crash
  PID:1504

memory/748-55-0x0000000001000000-0x0000000001018000-memory.dmp

Filesize
96KB

Download