879710312c4a39fbeee00326023fc6b6d8ab1f0df5467148d442e4a02ceb4db6

Analysis

max time kernel
38s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 21:45

Target

879710312c4a39fbeee00326023fc6b6d8ab1f0df5467148d442e4a02ceb4db6.exe
Size

51KB
MD5

736deb6f17ad61741a18aed4d0940a1e
SHA1

b18bce7b7b48731b1e6a8b8b2e80c041c6675edd
SHA256

879710312c4a39fbeee00326023fc6b6d8ab1f0df5467148d442e4a02ceb4db6
SHA512

3fd293d6ece04b526595c836de843a6dafdbf72e23c101c1d8da405de450da218693af7bc5ac3c9ef7ae3f77aac47a0c098d7ac01ba5a561fb646f4b8aaed149
SSDEEP

768:xLarjF8z1l8kkvQq2W76npDuUDjhyLe7ijOJ3A8VI2lL9N85ZnnDDS3+ei4BLTL:xWObqQOEEUJOjODK+L92ZnS3+ei4h

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
952	1728	WerFault.exe	11

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 952	1728	879710312c4a39fbeee00326023fc6b6d8ab1f0df5467148d442e4a02ceb4db6.exe	28
PID 1728 wrote to memory of 952	1728	879710312c4a39fbeee00326023fc6b6d8ab1f0df5467148d442e4a02ceb4db6.exe	28
PID 1728 wrote to memory of 952	1728	879710312c4a39fbeee00326023fc6b6d8ab1f0df5467148d442e4a02ceb4db6.exe	28
PID 1728 wrote to memory of 952	1728	879710312c4a39fbeee00326023fc6b6d8ab1f0df5467148d442e4a02ceb4db6.exe	28

C:\Users\Admin\AppData\Local\Temp\879710312c4a39fbeee00326023fc6b6d8ab1f0df5467148d442e4a02ceb4db6.exe
"C:\Users\Admin\AppData\Local\Temp\879710312c4a39fbeee00326023fc6b6d8ab1f0df5467148d442e4a02ceb4db6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 88
  2⤵
  - Program crash
  PID:952

memory/1728-55-0x00000000001B0000-0x00000000001B3000-memory.dmp

Filesize
12KB

Download