956177846edb33a871f05f49f62411e68c91b84805e8dafdddd3ae0818d85e89

Analysis

max time kernel
38s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 01:00

Target

956177846edb33a871f05f49f62411e68c91b84805e8dafdddd3ae0818d85e89.exe
Size

215KB
MD5

42771f4c9a932c78b083e6008672f7c7
SHA1

64c049834664285d798080f9e048422a198c7334
SHA256

956177846edb33a871f05f49f62411e68c91b84805e8dafdddd3ae0818d85e89
SHA512

229f8acd8cb5e72078f4358f2c57ad4cdd9b8ccba6180d09775114fc0b99b7df560a8014cd11c8ee13772f76218a1949b3ca6c65d23c6f725e7941f00c84f2d3
SSDEEP

6144:CQxeMuD8/4s+LHdHTg9ga3MBF6EXLEZd2R:3TuD8/jsTXrBtEZe

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1984	1764	WerFault.exe	23

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 1984	1764	956177846edb33a871f05f49f62411e68c91b84805e8dafdddd3ae0818d85e89.exe	26
PID 1764 wrote to memory of 1984	1764	956177846edb33a871f05f49f62411e68c91b84805e8dafdddd3ae0818d85e89.exe	26
PID 1764 wrote to memory of 1984	1764	956177846edb33a871f05f49f62411e68c91b84805e8dafdddd3ae0818d85e89.exe	26
PID 1764 wrote to memory of 1984	1764	956177846edb33a871f05f49f62411e68c91b84805e8dafdddd3ae0818d85e89.exe	26

C:\Users\Admin\AppData\Local\Temp\956177846edb33a871f05f49f62411e68c91b84805e8dafdddd3ae0818d85e89.exe
"C:\Users\Admin\AppData\Local\Temp\956177846edb33a871f05f49f62411e68c91b84805e8dafdddd3ae0818d85e89.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 172
  2⤵
  - Program crash
  PID:1984

memory/1764-54-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

Filesize
8KB

Download
memory/1764-55-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download