20c291ff04b11abc4c5e17ab70aeb4e817f4a7cfd8d305b8a377563c7ca9cdab

Analysis

max time kernel
41s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 17:29

Target

20c291ff04b11abc4c5e17ab70aeb4e817f4a7cfd8d305b8a377563c7ca9cdab.exe
Size

76KB
MD5

6748f5a9713c88984e58bd4c76311f2f
SHA1

a7f4787183b966b69cdaa2ef09f712c95210469a
SHA256

20c291ff04b11abc4c5e17ab70aeb4e817f4a7cfd8d305b8a377563c7ca9cdab
SHA512

9de4d93c09e15d63a20f32e71369e1440bc3d56b8506e03a5a1329331102d31db5fbb9e3c2e76538f49c45c14a85ae834b9fcc034fdad21a6810d64ad2b8def4
SSDEEP

1536:KevKtk/v2qyN/Upiv3exV2q8oKNv+yuyrawI0FLnNt60Q:Kei1qK/fvkV0NUyuyX3nD60Q

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1324	632	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 1324	632	20c291ff04b11abc4c5e17ab70aeb4e817f4a7cfd8d305b8a377563c7ca9cdab.exe	28
PID 632 wrote to memory of 1324	632	20c291ff04b11abc4c5e17ab70aeb4e817f4a7cfd8d305b8a377563c7ca9cdab.exe	28
PID 632 wrote to memory of 1324	632	20c291ff04b11abc4c5e17ab70aeb4e817f4a7cfd8d305b8a377563c7ca9cdab.exe	28
PID 632 wrote to memory of 1324	632	20c291ff04b11abc4c5e17ab70aeb4e817f4a7cfd8d305b8a377563c7ca9cdab.exe	28

C:\Users\Admin\AppData\Local\Temp\20c291ff04b11abc4c5e17ab70aeb4e817f4a7cfd8d305b8a377563c7ca9cdab.exe
"C:\Users\Admin\AppData\Local\Temp\20c291ff04b11abc4c5e17ab70aeb4e817f4a7cfd8d305b8a377563c7ca9cdab.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 108
  2⤵
  - Program crash
  PID:1324

memory/632-55-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download