7a219e4eb5dc73547f8f62c74c7e5ef2693eb92a0b03a04873594412223fec26

Analysis

max time kernel
3s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 22:27

Target

7a219e4eb5dc73547f8f62c74c7e5ef2693eb92a0b03a04873594412223fec26.exe
Size

71KB
MD5

5760fef5bc77227daa21fc8b10be3f58
SHA1

ac5a2a9d7d796b54df11e9d5772d487032e25435
SHA256

7a219e4eb5dc73547f8f62c74c7e5ef2693eb92a0b03a04873594412223fec26
SHA512

5cdef8c27bb1f698247f79e85076515b62d059a713681da3b8f081868eedbe6e8dca0a0d07422a4cd1fffaee4f16584a4a0ab2f410c2a35d23f61f66ad800bde
SSDEEP

1536:J09Qt5BbqJqr+Ls054mYYu22RBhTJ9EA5WhVt27A9Iqx8OX0dlc2Vt0:JZqMr+L/4bVRRBhN9F6Vt6YrX0Pw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1208	2040	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1208	2040	7a219e4eb5dc73547f8f62c74c7e5ef2693eb92a0b03a04873594412223fec26.exe	28
PID 2040 wrote to memory of 1208	2040	7a219e4eb5dc73547f8f62c74c7e5ef2693eb92a0b03a04873594412223fec26.exe	28
PID 2040 wrote to memory of 1208	2040	7a219e4eb5dc73547f8f62c74c7e5ef2693eb92a0b03a04873594412223fec26.exe	28
PID 2040 wrote to memory of 1208	2040	7a219e4eb5dc73547f8f62c74c7e5ef2693eb92a0b03a04873594412223fec26.exe	28

C:\Users\Admin\AppData\Local\Temp\7a219e4eb5dc73547f8f62c74c7e5ef2693eb92a0b03a04873594412223fec26.exe
"C:\Users\Admin\AppData\Local\Temp\7a219e4eb5dc73547f8f62c74c7e5ef2693eb92a0b03a04873594412223fec26.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 36
  2⤵
  - Program crash
  PID:1208

memory/2040-55-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download