2492da7976810f38a8940ec33bec474af040348255614abb495bdc6dc7e45638

Analysis

max time kernel
37s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 05:16

Target

2492da7976810f38a8940ec33bec474af040348255614abb495bdc6dc7e45638.exe
Size

804KB
MD5

35eaa415feb732e32be566bbdeb15b0c
SHA1

1fb5ff1a96a8fa3bc1687f497a897f82f3e0449a
SHA256

2492da7976810f38a8940ec33bec474af040348255614abb495bdc6dc7e45638
SHA512

047dd4f1bfe6102cbf93fe7da6ce790f7954cc81baa608b9cecb61b562acdc31a91fcd44af841e524d2d5c1a1923e39eb30adb6f54a1ac3effdacc5002882bb7
SSDEEP

12288:RqRrGNMqKlijOfeAs7prrWdRMoeNVRggEigxw:KrGWqKlijrzRHJCW3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1944	1708	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1944	1708	2492da7976810f38a8940ec33bec474af040348255614abb495bdc6dc7e45638.exe	26
PID 1708 wrote to memory of 1944	1708	2492da7976810f38a8940ec33bec474af040348255614abb495bdc6dc7e45638.exe	26
PID 1708 wrote to memory of 1944	1708	2492da7976810f38a8940ec33bec474af040348255614abb495bdc6dc7e45638.exe	26
PID 1708 wrote to memory of 1944	1708	2492da7976810f38a8940ec33bec474af040348255614abb495bdc6dc7e45638.exe	26

C:\Users\Admin\AppData\Local\Temp\2492da7976810f38a8940ec33bec474af040348255614abb495bdc6dc7e45638.exe
"C:\Users\Admin\AppData\Local\Temp\2492da7976810f38a8940ec33bec474af040348255614abb495bdc6dc7e45638.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 88
  2⤵
  - Program crash
  PID:1944