705d624259e31c1d77871d42dc2ca3751af056fbba73704b6d20680891639ef7

Analysis

max time kernel
3s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 04:25

Target

705d624259e31c1d77871d42dc2ca3751af056fbba73704b6d20680891639ef7.exe
Size

63KB
MD5

5e78c2b85605f7149e51f60ea4fb2fb9
SHA1

b2d2cb4a75fb4d06db07887ff1e56639c0fa3817
SHA256

705d624259e31c1d77871d42dc2ca3751af056fbba73704b6d20680891639ef7
SHA512

185771dd41b077e578dc432ec0a536905e841fdd1001554dea0f5331a81adfd8bf174e3d05b85c946664ddb4bb83cf2d19c1f8e9520079e216aed24552062122
SSDEEP

1536:o9qEb7WY4V9F6O3bNmOxdhx2/DZX7osDa0J:Eq4s9YO3bNmOVxwLthJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2008	2036	WerFault.exe	10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2008	2036	705d624259e31c1d77871d42dc2ca3751af056fbba73704b6d20680891639ef7.exe	28
PID 2036 wrote to memory of 2008	2036	705d624259e31c1d77871d42dc2ca3751af056fbba73704b6d20680891639ef7.exe	28
PID 2036 wrote to memory of 2008	2036	705d624259e31c1d77871d42dc2ca3751af056fbba73704b6d20680891639ef7.exe	28
PID 2036 wrote to memory of 2008	2036	705d624259e31c1d77871d42dc2ca3751af056fbba73704b6d20680891639ef7.exe	28

C:\Users\Admin\AppData\Local\Temp\705d624259e31c1d77871d42dc2ca3751af056fbba73704b6d20680891639ef7.exe
"C:\Users\Admin\AppData\Local\Temp\705d624259e31c1d77871d42dc2ca3751af056fbba73704b6d20680891639ef7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 36
  2⤵
  - Program crash
  PID:2008

memory/2036-55-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download