3fe6a663c2ab1a54df4678858ac2cc79e8aca7d4c12f278f8268a3f67616a380

Analysis

max time kernel
41s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 19:36

Target

3fe6a663c2ab1a54df4678858ac2cc79e8aca7d4c12f278f8268a3f67616a380.exe
Size

276KB
MD5

bb73a69190b33ee9bcba216215c2ba2e
SHA1

289f05195dd8bcfedddc6484a845475a1dff3ad5
SHA256

3fe6a663c2ab1a54df4678858ac2cc79e8aca7d4c12f278f8268a3f67616a380
SHA512

23a1b91243399a4a29658b3b7cb031c6e2994f49a835a9b3fd76eac198ebd40247a099be180755eb8b4298f9efed0c511bc269dcfed1caa41bb97900a2d39bdb
SSDEEP

6144:FvPCx6F4YXC0NbdjMSkwb2if1L5kz91xSxCFYd:FHCxHWbdjMNwbn9y6sY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1492	1676	WerFault.exe	27

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 1492	1676	3fe6a663c2ab1a54df4678858ac2cc79e8aca7d4c12f278f8268a3f67616a380.exe	28
PID 1676 wrote to memory of 1492	1676	3fe6a663c2ab1a54df4678858ac2cc79e8aca7d4c12f278f8268a3f67616a380.exe	28
PID 1676 wrote to memory of 1492	1676	3fe6a663c2ab1a54df4678858ac2cc79e8aca7d4c12f278f8268a3f67616a380.exe	28
PID 1676 wrote to memory of 1492	1676	3fe6a663c2ab1a54df4678858ac2cc79e8aca7d4c12f278f8268a3f67616a380.exe	28
PID 1676 wrote to memory of 1492	1676	3fe6a663c2ab1a54df4678858ac2cc79e8aca7d4c12f278f8268a3f67616a380.exe	28
PID 1676 wrote to memory of 1492	1676	3fe6a663c2ab1a54df4678858ac2cc79e8aca7d4c12f278f8268a3f67616a380.exe	28
PID 1676 wrote to memory of 1492	1676	3fe6a663c2ab1a54df4678858ac2cc79e8aca7d4c12f278f8268a3f67616a380.exe	28

C:\Users\Admin\AppData\Local\Temp\3fe6a663c2ab1a54df4678858ac2cc79e8aca7d4c12f278f8268a3f67616a380.exe
"C:\Users\Admin\AppData\Local\Temp\3fe6a663c2ab1a54df4678858ac2cc79e8aca7d4c12f278f8268a3f67616a380.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 256
  2⤵
  - Program crash
  PID:1492

memory/1676-54-0x0000000075A31000-0x0000000075A33000-memory.dmp

Filesize
8KB

Download
memory/1676-56-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1676-57-0x0000000000170000-0x00000000001B5000-memory.dmp

Filesize
276KB

Download