504aba9ffc85b963c92b2725c54b2f16e8dca913b5dbe2b7d75786eee3692a38

Analysis

max time kernel
38s
max time network
29s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 09:08

Target

©ɱ/095.exe
Size

91KB
MD5

51cb4dfc2b2f5a5ffbd8f7cf2da9fe00
SHA1

f8575340416ba08ec070eba09d92f5be43a0cfbf
SHA256

a7fd4c347e3050e9727276234da1d12684680932ec16354e78559cfcfa2cd2b8
SHA512

0a065447a6596f3d94c1b7a522a178f638305a87c053e589c9887e1c858f9689553a9ae9d3820025dfde6b518efdbe1281f05b349b9d20a55859e56937a3478f
SSDEEP

1536:JqYBPvt0g3D88rW+NdySd6o2C9yZkHEXE9mWx7XRD+9T8cBfdqmGFL1M7zvU/9ol:JqYBPlF3Is9dAagZkkXE97FvWfdqmGFu

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1812 1272 WerFault.exe 095.exe

pid	pid_target	process	target process
1812	1272	WerFault.exe	095.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

095.exe

description	pid	process	target process
PID 1272 wrote to memory of 1812	1272	095.exe	WerFault.exe
PID 1272 wrote to memory of 1812	1272	095.exe	WerFault.exe
PID 1272 wrote to memory of 1812	1272	095.exe	WerFault.exe
PID 1272 wrote to memory of 1812	1272	095.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\©ɱ\095.exe
"C:\Users\Admin\AppData\Local\Temp\©ɱ\095.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 36
2⤵
- Program crash
PID:1812

memory/1272-55-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1812-54-0x0000000000000000-mapping.dmp

Download