7841bb9dba5a3ffd8f69fa85cd3661bffaaddd1868533ce9a60f8a4e9b60a983

Analysis

max time kernel
3s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 16:47

Target

7841bb9dba5a3ffd8f69fa85cd3661bffaaddd1868533ce9a60f8a4e9b60a983.exe
Size

107KB
MD5

43967ed6170bbb913305d6f9617ae12d
SHA1

3487480773d892435174bbbf07abe24dcac83565
SHA256

7841bb9dba5a3ffd8f69fa85cd3661bffaaddd1868533ce9a60f8a4e9b60a983
SHA512

826dde99489ca4cc7edff78e65102f485ac5dc9773d057648b2d227cdb1c20edd083445aafce24c8bd10705cd2c7a053e22f3fd353b9fd8d2340b4ff6bc90791
SSDEEP

1536:evswMYx51srWTbVZHrZ2sKo67MT2X9hYDFe8pRt2jEXK:evTMY1sI/LZZKo67WU9oFFi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1756	2036	WerFault.exe	18

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1756	2036	7841bb9dba5a3ffd8f69fa85cd3661bffaaddd1868533ce9a60f8a4e9b60a983.exe	28
PID 2036 wrote to memory of 1756	2036	7841bb9dba5a3ffd8f69fa85cd3661bffaaddd1868533ce9a60f8a4e9b60a983.exe	28
PID 2036 wrote to memory of 1756	2036	7841bb9dba5a3ffd8f69fa85cd3661bffaaddd1868533ce9a60f8a4e9b60a983.exe	28
PID 2036 wrote to memory of 1756	2036	7841bb9dba5a3ffd8f69fa85cd3661bffaaddd1868533ce9a60f8a4e9b60a983.exe	28

C:\Users\Admin\AppData\Local\Temp\7841bb9dba5a3ffd8f69fa85cd3661bffaaddd1868533ce9a60f8a4e9b60a983.exe
"C:\Users\Admin\AppData\Local\Temp\7841bb9dba5a3ffd8f69fa85cd3661bffaaddd1868533ce9a60f8a4e9b60a983.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 136
  2⤵
  - Program crash
  PID:1756

memory/2036-54-0x0000000075511000-0x0000000075513000-memory.dmp

Filesize
8KB

Download