493767ec9b062feef27af4fc439805cc773c3877b6c392a12167306d37b49f0b

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 09:19

Target

493767ec9b062feef27af4fc439805cc773c3877b6c392a12167306d37b49f0b.exe
Size

79KB
MD5

ef4cfa5b27da6e2ff2b294845bde0669
SHA1

cd6b43c1b6ae0e9186d5ad414fb9c0fdff5742fd
SHA256

493767ec9b062feef27af4fc439805cc773c3877b6c392a12167306d37b49f0b
SHA512

f6782b780bb38ffa0eb2805f2f62bfbdf4d7009d0ccc20fa72cac85a246561745feef1e900cb6f4fdc00bcee2ca76be7bbc9a8c6d910817720ed87820b4b8372
SSDEEP

1536:HG9jbC9mYqKYDhNrxpOoEly6GLKZQDpn9piGiNkoilH9M0ctW+Y3JYmvA4J8PaKa:m9aMx7FRf6kKZmJqXypxmiKa

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1672	1736	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1672	1736	493767ec9b062feef27af4fc439805cc773c3877b6c392a12167306d37b49f0b.exe	28
PID 1736 wrote to memory of 1672	1736	493767ec9b062feef27af4fc439805cc773c3877b6c392a12167306d37b49f0b.exe	28
PID 1736 wrote to memory of 1672	1736	493767ec9b062feef27af4fc439805cc773c3877b6c392a12167306d37b49f0b.exe	28
PID 1736 wrote to memory of 1672	1736	493767ec9b062feef27af4fc439805cc773c3877b6c392a12167306d37b49f0b.exe	28

C:\Users\Admin\AppData\Local\Temp\493767ec9b062feef27af4fc439805cc773c3877b6c392a12167306d37b49f0b.exe
"C:\Users\Admin\AppData\Local\Temp\493767ec9b062feef27af4fc439805cc773c3877b6c392a12167306d37b49f0b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 88
  2⤵
  - Program crash
  PID:1672

memory/1736-55-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download