afb797ebf95844351d152254436eae95ef0c14ad3e88dbb08b736460dca34b35

Analysis

max time kernel
37s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 03:07

Target

afb797ebf95844351d152254436eae95ef0c14ad3e88dbb08b736460dca34b35.exe
Size

65KB
MD5

cf2319a328d1d6d10d4e28e1cb53e7c8
SHA1

1f5d619ae60200a89e3ae0c54bd885afa6fb216b
SHA256

afb797ebf95844351d152254436eae95ef0c14ad3e88dbb08b736460dca34b35
SHA512

42816e7693ef940501cecb6b8f817690a6998d9406bcd1267912c3814c0e76464d8fdbe3150a9fe14bdb4ab8613eebd57baa272a8c40adbfdaa7aa58f4fe73e3
SSDEEP

1536:14vQFZ7Fxqlq+MLMRqyBpFsFJ69fp597DHq0GC:14v2ZFxqMFyBpFsFQ/nq9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1172	1132	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 1172	1132	afb797ebf95844351d152254436eae95ef0c14ad3e88dbb08b736460dca34b35.exe	27
PID 1132 wrote to memory of 1172	1132	afb797ebf95844351d152254436eae95ef0c14ad3e88dbb08b736460dca34b35.exe	27
PID 1132 wrote to memory of 1172	1132	afb797ebf95844351d152254436eae95ef0c14ad3e88dbb08b736460dca34b35.exe	27
PID 1132 wrote to memory of 1172	1132	afb797ebf95844351d152254436eae95ef0c14ad3e88dbb08b736460dca34b35.exe	27

C:\Users\Admin\AppData\Local\Temp\afb797ebf95844351d152254436eae95ef0c14ad3e88dbb08b736460dca34b35.exe
"C:\Users\Admin\AppData\Local\Temp\afb797ebf95844351d152254436eae95ef0c14ad3e88dbb08b736460dca34b35.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1132 -s 84
  2⤵
  - Program crash
  PID:1172

memory/1132-55-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download