19b68a8956851abe1e5cf194b37e1bf41425bd2c15aeba94505ffba3f1f3109d

Analysis

max time kernel
12s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 10:36

Target

19b68a8956851abe1e5cf194b37e1bf41425bd2c15aeba94505ffba3f1f3109d.exe
Size

59KB
MD5

2606bca2e8bad487962987fbe94fafe0
SHA1

f4ef30def757bb879614ceef00dabbc607192e44
SHA256

19b68a8956851abe1e5cf194b37e1bf41425bd2c15aeba94505ffba3f1f3109d
SHA512

009d6ab3ad24d6d9121b4d47119b19a38b1539b539e2e6440994077382455b8ee0ffd3426e0e616d36039edc171712a1e9b08683b89d4fefd81b927a0fbc6b6d
SSDEEP

768:t/6dJimFSPf2v+YSGAmt7JwEnvgxaBppL8K/epIm34Kty9dyaxMYLTLObgO6GN:teimFsy+mno28KWpImCwaxJqbeGN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1900	1760	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 1900	1760	19b68a8956851abe1e5cf194b37e1bf41425bd2c15aeba94505ffba3f1f3109d.exe	28
PID 1760 wrote to memory of 1900	1760	19b68a8956851abe1e5cf194b37e1bf41425bd2c15aeba94505ffba3f1f3109d.exe	28
PID 1760 wrote to memory of 1900	1760	19b68a8956851abe1e5cf194b37e1bf41425bd2c15aeba94505ffba3f1f3109d.exe	28

C:\Users\Admin\AppData\Local\Temp\19b68a8956851abe1e5cf194b37e1bf41425bd2c15aeba94505ffba3f1f3109d.exe
"C:\Users\Admin\AppData\Local\Temp\19b68a8956851abe1e5cf194b37e1bf41425bd2c15aeba94505ffba3f1f3109d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1760 -s 532
  2⤵
  - Program crash
  PID:1900

memory/1760-54-0x0000000000EC0000-0x0000000000ED6000-memory.dmp

Filesize
88KB

Download