71f41eff7e639a6a021fb8455791aa09834489f9b7f7cb005eccdccb1c0ecfc7

Analysis

max time kernel
39s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 05:14

Target

71f41eff7e639a6a021fb8455791aa09834489f9b7f7cb005eccdccb1c0ecfc7.exe
Size

312KB
MD5

3af77da816a967fd4ab52de74efed54b
SHA1

62a44aa64a3823e6474b3f8f8c1fcea421ebc35b
SHA256

71f41eff7e639a6a021fb8455791aa09834489f9b7f7cb005eccdccb1c0ecfc7
SHA512

7455b0a4b242a8240609549449852576c23f38c4c37f02bebbc80f69c905f3e1085a5c162e9bbf3ccf676a13f0adf41f7f77c2144a5a8864e1505670fd3cb8f8
SSDEEP

6144:1J5e6D1oSfqVhTjgJceNJJpMRHOHwIFMvAxbWrPuu:z5PfqTTMueVpMR0FMv9rPuu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1476	1096	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1476	1096	71f41eff7e639a6a021fb8455791aa09834489f9b7f7cb005eccdccb1c0ecfc7.exe	26
PID 1096 wrote to memory of 1476	1096	71f41eff7e639a6a021fb8455791aa09834489f9b7f7cb005eccdccb1c0ecfc7.exe	26
PID 1096 wrote to memory of 1476	1096	71f41eff7e639a6a021fb8455791aa09834489f9b7f7cb005eccdccb1c0ecfc7.exe	26
PID 1096 wrote to memory of 1476	1096	71f41eff7e639a6a021fb8455791aa09834489f9b7f7cb005eccdccb1c0ecfc7.exe	26

C:\Users\Admin\AppData\Local\Temp\71f41eff7e639a6a021fb8455791aa09834489f9b7f7cb005eccdccb1c0ecfc7.exe
"C:\Users\Admin\AppData\Local\Temp\71f41eff7e639a6a021fb8455791aa09834489f9b7f7cb005eccdccb1c0ecfc7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 36
  2⤵
  - Program crash
  PID:1476

memory/1096-54-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download