ff36a7661d7cbfb8366b1e77ef5ac86298c2b41d7158fceff28f2b66c1977706

Analysis

max time kernel
4s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 21:52

Target

ff36a7661d7cbfb8366b1e77ef5ac86298c2b41d7158fceff28f2b66c1977706.exe
Size

119KB
MD5

43e412bf2a4afff234ac2536d646e198
SHA1

c1346818694cc4e4dde10098bb1c7a5ce0f9477b
SHA256

ff36a7661d7cbfb8366b1e77ef5ac86298c2b41d7158fceff28f2b66c1977706
SHA512

76b148907fd9b06a4ad7d409d38927ff5677cc047ffb681ab1b7d35eccec261d2394b5b3ca394141e976b93e05d72e17b92f249780df2f4998f755f92c20f003
SSDEEP

1536:r7kkkkqsQdP/10hLiCCbEgmIooSnFAA5N5ek6MGnV13pjVrs2ryrd1vUQuqSSqKk:ruDmdrCbEtoYFAepAtHs2qxnC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1352	1228	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 1352	1228	ff36a7661d7cbfb8366b1e77ef5ac86298c2b41d7158fceff28f2b66c1977706.exe	28
PID 1228 wrote to memory of 1352	1228	ff36a7661d7cbfb8366b1e77ef5ac86298c2b41d7158fceff28f2b66c1977706.exe	28
PID 1228 wrote to memory of 1352	1228	ff36a7661d7cbfb8366b1e77ef5ac86298c2b41d7158fceff28f2b66c1977706.exe	28
PID 1228 wrote to memory of 1352	1228	ff36a7661d7cbfb8366b1e77ef5ac86298c2b41d7158fceff28f2b66c1977706.exe	28

C:\Users\Admin\AppData\Local\Temp\ff36a7661d7cbfb8366b1e77ef5ac86298c2b41d7158fceff28f2b66c1977706.exe
"C:\Users\Admin\AppData\Local\Temp\ff36a7661d7cbfb8366b1e77ef5ac86298c2b41d7158fceff28f2b66c1977706.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 36
  2⤵
  - Program crash
  PID:1352

memory/1228-54-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download