742e178a347f3a3f8f126e9cd8ea0bbba6a195e66f207ddd8e331530f78ede29

Analysis

max time kernel
38s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 07:48

Target

742e178a347f3a3f8f126e9cd8ea0bbba6a195e66f207ddd8e331530f78ede29.exe
Size

157KB
MD5

21f6ae0672e9b0618ff8a451ea411680
SHA1

886d575b496ce00357e616de5720541176ebcd71
SHA256

742e178a347f3a3f8f126e9cd8ea0bbba6a195e66f207ddd8e331530f78ede29
SHA512

90f959bfc5fbd5f1756a28a961ba564d884573812465686663fa943064354bad725a1e2edf72db470739399ba3ecbe2a32a5f902c1de05410d907a724bcced81
SSDEEP

3072:Mr6W2wIcju6IIXlNPQmTh907Y6lP/8qkrHK:Q6gI4u6lXnxh65Q

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1056	1488	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1056	1488	742e178a347f3a3f8f126e9cd8ea0bbba6a195e66f207ddd8e331530f78ede29.exe	26
PID 1488 wrote to memory of 1056	1488	742e178a347f3a3f8f126e9cd8ea0bbba6a195e66f207ddd8e331530f78ede29.exe	26
PID 1488 wrote to memory of 1056	1488	742e178a347f3a3f8f126e9cd8ea0bbba6a195e66f207ddd8e331530f78ede29.exe	26
PID 1488 wrote to memory of 1056	1488	742e178a347f3a3f8f126e9cd8ea0bbba6a195e66f207ddd8e331530f78ede29.exe	26

C:\Users\Admin\AppData\Local\Temp\742e178a347f3a3f8f126e9cd8ea0bbba6a195e66f207ddd8e331530f78ede29.exe
"C:\Users\Admin\AppData\Local\Temp\742e178a347f3a3f8f126e9cd8ea0bbba6a195e66f207ddd8e331530f78ede29.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 172
  2⤵
  - Program crash
  PID:1056

memory/1488-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/1488-55-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download