618d8a4bd2c0f7ed621c04d82f45a12c41a672a2134fff11efab81ce47ece197

Analysis

max time kernel
30s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 23:24

Target

618d8a4bd2c0f7ed621c04d82f45a12c41a672a2134fff11efab81ce47ece197.exe
Size

194KB
MD5

25322c9add525be06e496bb84b7e20af
SHA1

b04141c1643ff2e9fb7153a9238912155c69dad5
SHA256

618d8a4bd2c0f7ed621c04d82f45a12c41a672a2134fff11efab81ce47ece197
SHA512

766c96d86228bff89cc8e734bed640599d6cac1ad3fcad7d306f0eb837d6e4923336c1231f33363a02a199bdc0f874eaa51b6a1b2bd3f5e227d9fd0f33fde2e5
SSDEEP

3072:YYNQKPWDyDRefVJltZrpRl1P3ylY/3CrrgLJmsa+9KXhwMsDZa6ymfmz:hNSDyDRO1thpP3/LJmWKXhwtly1z

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1368	1916	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 1368	1916	618d8a4bd2c0f7ed621c04d82f45a12c41a672a2134fff11efab81ce47ece197.exe	28
PID 1916 wrote to memory of 1368	1916	618d8a4bd2c0f7ed621c04d82f45a12c41a672a2134fff11efab81ce47ece197.exe	28
PID 1916 wrote to memory of 1368	1916	618d8a4bd2c0f7ed621c04d82f45a12c41a672a2134fff11efab81ce47ece197.exe	28
PID 1916 wrote to memory of 1368	1916	618d8a4bd2c0f7ed621c04d82f45a12c41a672a2134fff11efab81ce47ece197.exe	28

C:\Users\Admin\AppData\Local\Temp\618d8a4bd2c0f7ed621c04d82f45a12c41a672a2134fff11efab81ce47ece197.exe
"C:\Users\Admin\AppData\Local\Temp\618d8a4bd2c0f7ed621c04d82f45a12c41a672a2134fff11efab81ce47ece197.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 160
  2⤵
  - Program crash
  PID:1368

memory/1916-54-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download
memory/1916-56-0x0000000001000000-0x000000000102C000-memory.dmp

Filesize
176KB

Download