7be552dce863c66841fa21bbab8ad08b5b4f0d9ea7404868d44655a14a3da9e3

Analysis

max time kernel
6s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 13:02

Target

7be552dce863c66841fa21bbab8ad08b5b4f0d9ea7404868d44655a14a3da9e3.exe
Size

127KB
MD5

220a9c067460d64ef7946bd5b10263da
SHA1

f8f2a9a698145624fd6bdca1304e11d1f7e84565
SHA256

7be552dce863c66841fa21bbab8ad08b5b4f0d9ea7404868d44655a14a3da9e3
SHA512

7e6f99d145e8275a7d7f5af66c8352877d9669bdda9dff0476dddfdb16342fab61825766639a2d8f8bbb41ec3591a0600aa1bdfd3e6adae49c2454d85680ed19
SSDEEP

3072:vuSRfDnNhoqmKqu6/DzcYZ89UCTALXZvfOo:1baWEX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1764	1980	WerFault.exe	18

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1764	1980	7be552dce863c66841fa21bbab8ad08b5b4f0d9ea7404868d44655a14a3da9e3.exe	28
PID 1980 wrote to memory of 1764	1980	7be552dce863c66841fa21bbab8ad08b5b4f0d9ea7404868d44655a14a3da9e3.exe	28
PID 1980 wrote to memory of 1764	1980	7be552dce863c66841fa21bbab8ad08b5b4f0d9ea7404868d44655a14a3da9e3.exe	28
PID 1980 wrote to memory of 1764	1980	7be552dce863c66841fa21bbab8ad08b5b4f0d9ea7404868d44655a14a3da9e3.exe	28

C:\Users\Admin\AppData\Local\Temp\7be552dce863c66841fa21bbab8ad08b5b4f0d9ea7404868d44655a14a3da9e3.exe
"C:\Users\Admin\AppData\Local\Temp\7be552dce863c66841fa21bbab8ad08b5b4f0d9ea7404868d44655a14a3da9e3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 44
  2⤵
  - Program crash
  PID:1764