88dea5c7f91c09cafc5282a771f5827db1068761b9b146c98474117bcf5b665a

Analysis

max time kernel
23s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 06:32

Target

88dea5c7f91c09cafc5282a771f5827db1068761b9b146c98474117bcf5b665a.exe
Size

76KB
MD5

f14d2a24de1310e913465716ea399722
SHA1

05352df1cdd675323efda79b87bff2f06357828e
SHA256

88dea5c7f91c09cafc5282a771f5827db1068761b9b146c98474117bcf5b665a
SHA512

17a8e80de94b0793f1fa3f8fb7b512c27f935b8ba29643ece0509a867118a0b168f187876f6da0d3d0181ec68fdf21e6d00490c8f1b9730e41098cf1420fd38a
SSDEEP

1536:rWzzzxhWJp6NnBVu/YpFFPjwURmeaRe/UhtEOg/F4+DGCjpjVrs2ryrd1vUQuq6:rWzzzQp6NnBwApz/mVA/qiOg/F4CGCjn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
884	1652	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 884	1652	88dea5c7f91c09cafc5282a771f5827db1068761b9b146c98474117bcf5b665a.exe	27
PID 1652 wrote to memory of 884	1652	88dea5c7f91c09cafc5282a771f5827db1068761b9b146c98474117bcf5b665a.exe	27
PID 1652 wrote to memory of 884	1652	88dea5c7f91c09cafc5282a771f5827db1068761b9b146c98474117bcf5b665a.exe	27
PID 1652 wrote to memory of 884	1652	88dea5c7f91c09cafc5282a771f5827db1068761b9b146c98474117bcf5b665a.exe	27

C:\Users\Admin\AppData\Local\Temp\88dea5c7f91c09cafc5282a771f5827db1068761b9b146c98474117bcf5b665a.exe
"C:\Users\Admin\AppData\Local\Temp\88dea5c7f91c09cafc5282a771f5827db1068761b9b146c98474117bcf5b665a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 36
  2⤵
  - Program crash
  PID:884

memory/1652-55-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download