77396358a9d068810f107ba6f3b4ea7a5ad8cfd79a5280e261851f1a5a012f9e

Analysis

max time kernel
4s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 22:27

Target

77396358a9d068810f107ba6f3b4ea7a5ad8cfd79a5280e261851f1a5a012f9e.exe
Size

91KB
MD5

356d0b23332b789a7e00ad759e50903e
SHA1

6cf5b78a33aa9ae412a516ac57149ba72c3cb875
SHA256

77396358a9d068810f107ba6f3b4ea7a5ad8cfd79a5280e261851f1a5a012f9e
SHA512

fe49ccf6c336a44f3b08de54f69b9e9ab4f1d11a27a5cc7a64effa4c3ff694ac952bfbb4acb57fff3ccc5a6203fdf178dc560f70abbcff24d85eed322d362736
SSDEEP

1536:ed+b/57vmGm8NbVh/w6Ivp3+Thnxbx3q0rWLqQ41G7P:eAcD8NbVOa3nrWWQRP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
528	1724	WerFault.exe	19

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 528	1724	77396358a9d068810f107ba6f3b4ea7a5ad8cfd79a5280e261851f1a5a012f9e.exe	27
PID 1724 wrote to memory of 528	1724	77396358a9d068810f107ba6f3b4ea7a5ad8cfd79a5280e261851f1a5a012f9e.exe	27
PID 1724 wrote to memory of 528	1724	77396358a9d068810f107ba6f3b4ea7a5ad8cfd79a5280e261851f1a5a012f9e.exe	27
PID 1724 wrote to memory of 528	1724	77396358a9d068810f107ba6f3b4ea7a5ad8cfd79a5280e261851f1a5a012f9e.exe	27

C:\Users\Admin\AppData\Local\Temp\77396358a9d068810f107ba6f3b4ea7a5ad8cfd79a5280e261851f1a5a012f9e.exe
"C:\Users\Admin\AppData\Local\Temp\77396358a9d068810f107ba6f3b4ea7a5ad8cfd79a5280e261851f1a5a012f9e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 36
  2⤵
  - Program crash
  PID:528

memory/1724-55-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download