333f0c9eae2fc24ac18973c18045e3958f3a079e4f797397c9926f7adddf1311

Analysis

max time kernel
3s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26/11/2022, 00:14

Target

333f0c9eae2fc24ac18973c18045e3958f3a079e4f797397c9926f7adddf1311.exe
Size

78KB
MD5

7fb392f15249633c3a0916d186d85715
SHA1

4fc94bd79290ddbf2905d1e302089e9a22fc2f8e
SHA256

333f0c9eae2fc24ac18973c18045e3958f3a079e4f797397c9926f7adddf1311
SHA512

ec819090b37919847b6d6cb98ab5e32bbbf211f8c8f06eec393d7a7ebbf4be6224063614417720550d18099035703692ddf19d0085b32ab094bb58c345893ed3
SSDEEP

1536:1O3RhXLyteBWm73X+JrPtmB4KRAp0KHmcsLSGnv1QsXBY6I4:8yMv3XLeKypXmcsJtI4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
828	1800	WerFault.exe	28

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 1800	1552	333f0c9eae2fc24ac18973c18045e3958f3a079e4f797397c9926f7adddf1311.exe	28
PID 1552 wrote to memory of 1800	1552	333f0c9eae2fc24ac18973c18045e3958f3a079e4f797397c9926f7adddf1311.exe	28
PID 1552 wrote to memory of 1800	1552	333f0c9eae2fc24ac18973c18045e3958f3a079e4f797397c9926f7adddf1311.exe	28
PID 1552 wrote to memory of 1800	1552	333f0c9eae2fc24ac18973c18045e3958f3a079e4f797397c9926f7adddf1311.exe	28
PID 1552 wrote to memory of 1800	1552	333f0c9eae2fc24ac18973c18045e3958f3a079e4f797397c9926f7adddf1311.exe	28
PID 1552 wrote to memory of 1800	1552	333f0c9eae2fc24ac18973c18045e3958f3a079e4f797397c9926f7adddf1311.exe	28
PID 1552 wrote to memory of 1800	1552	333f0c9eae2fc24ac18973c18045e3958f3a079e4f797397c9926f7adddf1311.exe	28
PID 1552 wrote to memory of 1800	1552	333f0c9eae2fc24ac18973c18045e3958f3a079e4f797397c9926f7adddf1311.exe	28
PID 1552 wrote to memory of 1800	1552	333f0c9eae2fc24ac18973c18045e3958f3a079e4f797397c9926f7adddf1311.exe	28
PID 1800 wrote to memory of 828	1800	explorer.exe	29
PID 1800 wrote to memory of 828	1800	explorer.exe	29
PID 1800 wrote to memory of 828	1800	explorer.exe	29
PID 1800 wrote to memory of 828	1800	explorer.exe	29

C:\Users\Admin\AppData\Local\Temp\333f0c9eae2fc24ac18973c18045e3958f3a079e4f797397c9926f7adddf1311.exe
"C:\Users\Admin\AppData\Local\Temp\333f0c9eae2fc24ac18973c18045e3958f3a079e4f797397c9926f7adddf1311.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\SysWOW64\explorer.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 232
    3⤵
    - Program crash
    PID:828

memory/1552-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/1552-60-0x0000000000250000-0x0000000000254000-memory.dmp

Filesize
16KB

Download
memory/1552-61-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1800-55-0x0000000000090000-0x0000000000094000-memory.dmp

Filesize
16KB

Download
memory/1800-57-0x00000000000A0000-0x00000000000A3000-memory.dmp

Filesize
12KB

Download
memory/1800-63-0x0000000074711000-0x0000000074713000-memory.dmp

Filesize
8KB

Download