a7926982af720d1463e689d8a221079fac70dc06d11137a39eb7f1a1a0b24c13

Analysis

max time kernel
259s
max time network
337s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
30/11/2022, 23:47

Target

a7926982af720d1463e689d8a221079fac70dc06d11137a39eb7f1a1a0b24c13.exe
Size

210KB
MD5

41f52ae7d5e27657de28ac7f6c578397
SHA1

5a095baf5446b34b53cc21e934a2991a66285ba7
SHA256

a7926982af720d1463e689d8a221079fac70dc06d11137a39eb7f1a1a0b24c13
SHA512

ac9e9df04517f4ea45bb8f4c6040e4dd2332b3bd62fd327bc14d25aeb271bc747720127a6b71bcf40bd4851a9189eb0a95a23e09f648374258bbad0eb9c716a2
SSDEEP

384:L3wIA7GjuG6nnP9TDWsKAkk/fG8+lmQP+0JSfgyz:TwIA7QYtDUAdnemQVSfg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
760	1868	WerFault.exe	17

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 760	1868	a7926982af720d1463e689d8a221079fac70dc06d11137a39eb7f1a1a0b24c13.exe	28
PID 1868 wrote to memory of 760	1868	a7926982af720d1463e689d8a221079fac70dc06d11137a39eb7f1a1a0b24c13.exe	28
PID 1868 wrote to memory of 760	1868	a7926982af720d1463e689d8a221079fac70dc06d11137a39eb7f1a1a0b24c13.exe	28
PID 1868 wrote to memory of 760	1868	a7926982af720d1463e689d8a221079fac70dc06d11137a39eb7f1a1a0b24c13.exe	28
PID 1868 wrote to memory of 760	1868	a7926982af720d1463e689d8a221079fac70dc06d11137a39eb7f1a1a0b24c13.exe	28
PID 1868 wrote to memory of 760	1868	a7926982af720d1463e689d8a221079fac70dc06d11137a39eb7f1a1a0b24c13.exe	28
PID 1868 wrote to memory of 760	1868	a7926982af720d1463e689d8a221079fac70dc06d11137a39eb7f1a1a0b24c13.exe	28

C:\Users\Admin\AppData\Local\Temp\a7926982af720d1463e689d8a221079fac70dc06d11137a39eb7f1a1a0b24c13.exe
"C:\Users\Admin\AppData\Local\Temp\a7926982af720d1463e689d8a221079fac70dc06d11137a39eb7f1a1a0b24c13.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 324
  2⤵
  - Program crash
  PID:760

memory/1868-54-0x0000000075C11000-0x0000000075C13000-memory.dmp

Filesize
8KB

Download
memory/1868-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1868-57-0x0000000000270000-0x00000000002A3000-memory.dmp

Filesize
204KB

Download
memory/1868-58-0x0000000000270000-0x00000000002A3000-memory.dmp

Filesize
204KB

Download
memory/1868-59-0x0000000000270000-0x00000000002A3000-memory.dmp

Filesize
204KB

Download
memory/1868-60-0x0000000000270000-0x00000000002A3000-memory.dmp

Filesize
204KB

Download
memory/1868-61-0x0000000000270000-0x00000000002A3000-memory.dmp

Filesize
204KB

Download
memory/1868-62-0x0000000000270000-0x00000000002A3000-memory.dmp

Filesize
204KB

Download