84ac97478a7604c4151c6a009b8d69c58c6b94e31d1384569880e0568879cf2e

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 22:00

Target

84ac97478a7604c4151c6a009b8d69c58c6b94e31d1384569880e0568879cf2e.exe
Size

915KB
MD5

446190e637e5817890cfea6fea283205
SHA1

a5d4d5030635aaa0ade3742ff86e43f5f935058e
SHA256

84ac97478a7604c4151c6a009b8d69c58c6b94e31d1384569880e0568879cf2e
SHA512

c38163fc046b5827519769f0794a95b86193bf55abd026e492d5a9a6e343bb4c156ae6f7164d703c58b17649070d6e63e1df6d32a4fd3950a0e520ab304c0703
SSDEEP

24576:/hS3X0H3o9m2+2OcAjY1flpik8Qia4qmvim33t5KjLr:2X0H3o02uj+tpi7+43t5or

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
976	828	WerFault.exe	24

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 976	828	84ac97478a7604c4151c6a009b8d69c58c6b94e31d1384569880e0568879cf2e.exe	27
PID 828 wrote to memory of 976	828	84ac97478a7604c4151c6a009b8d69c58c6b94e31d1384569880e0568879cf2e.exe	27
PID 828 wrote to memory of 976	828	84ac97478a7604c4151c6a009b8d69c58c6b94e31d1384569880e0568879cf2e.exe	27
PID 828 wrote to memory of 976	828	84ac97478a7604c4151c6a009b8d69c58c6b94e31d1384569880e0568879cf2e.exe	27

C:\Users\Admin\AppData\Local\Temp\84ac97478a7604c4151c6a009b8d69c58c6b94e31d1384569880e0568879cf2e.exe
"C:\Users\Admin\AppData\Local\Temp\84ac97478a7604c4151c6a009b8d69c58c6b94e31d1384569880e0568879cf2e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 216
  2⤵
  - Program crash
  PID:976

memory/828-54-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download
memory/828-56-0x0000000000400000-0x00000000006A9000-memory.dmp

Filesize
2.7MB

Download