a57274c591c8ba65700c4334064c125a63f083733b9e97eaec9091a4fbe7118f

Analysis

max time kernel
27s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/11/2022, 23:56

Target

a57274c591c8ba65700c4334064c125a63f083733b9e97eaec9091a4fbe7118f.exe
Size

286KB
MD5

56696eaada8a7cbacf62221411cc81a0
SHA1

c3c5811c3cd81b8ad007c03c1185969e557e9feb
SHA256

a57274c591c8ba65700c4334064c125a63f083733b9e97eaec9091a4fbe7118f
SHA512

cfc082e02b169adec2198873b6f3b3dd8a66ca6005fb25a5f726ed4fe25a13d318770663a98ae150ef25b6990e9cd0d8d4279c019cbeddfb8fa8ede76e693af0
SSDEEP

3072:zDahPBarKpbqSAhVbhDIqfv5vMHW7e0NBVQtCaEnAtN8SV:ChPBarKpY9v50HT0NPQtTN8C

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2016	896	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 2016	896	a57274c591c8ba65700c4334064c125a63f083733b9e97eaec9091a4fbe7118f.exe	28
PID 896 wrote to memory of 2016	896	a57274c591c8ba65700c4334064c125a63f083733b9e97eaec9091a4fbe7118f.exe	28
PID 896 wrote to memory of 2016	896	a57274c591c8ba65700c4334064c125a63f083733b9e97eaec9091a4fbe7118f.exe	28
PID 896 wrote to memory of 2016	896	a57274c591c8ba65700c4334064c125a63f083733b9e97eaec9091a4fbe7118f.exe	28

C:\Users\Admin\AppData\Local\Temp\a57274c591c8ba65700c4334064c125a63f083733b9e97eaec9091a4fbe7118f.exe
"C:\Users\Admin\AppData\Local\Temp\a57274c591c8ba65700c4334064c125a63f083733b9e97eaec9091a4fbe7118f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 896 -s 148
  2⤵
  - Program crash
  PID:2016

memory/896-55-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download