7fd2e1c7ef6dbf84951a08ea1861458c691fd553dc93564c765436a9932d5c9e

Analysis

max time kernel
149s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 02:32

Target

7fd2e1c7ef6dbf84951a08ea1861458c691fd553dc93564c765436a9932d5c9e.exe
Size

259KB
MD5

e4827a3709814fe9bc020a08ce169d4b
SHA1

7e533dc09fa0eb18b4171916e04cf0e254d3a1f5
SHA256

7fd2e1c7ef6dbf84951a08ea1861458c691fd553dc93564c765436a9932d5c9e
SHA512

dba935665033d8764a86818f8277f56720a08f1a37aef8430a14f4eba7a7f7f92ba24eae81cdebe650537d2724f363f0a58ade3deae71b96fb8e2b1ad4ba4a69
SSDEEP

6144:ZOTeHI8HiL7+f5Dj1TUfYM30NBwO8o0otA:IeoGiLaZBT653fO8oXtA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1252	2040	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1252	2040	7fd2e1c7ef6dbf84951a08ea1861458c691fd553dc93564c765436a9932d5c9e.exe	28
PID 2040 wrote to memory of 1252	2040	7fd2e1c7ef6dbf84951a08ea1861458c691fd553dc93564c765436a9932d5c9e.exe	28
PID 2040 wrote to memory of 1252	2040	7fd2e1c7ef6dbf84951a08ea1861458c691fd553dc93564c765436a9932d5c9e.exe	28
PID 2040 wrote to memory of 1252	2040	7fd2e1c7ef6dbf84951a08ea1861458c691fd553dc93564c765436a9932d5c9e.exe	28

C:\Users\Admin\AppData\Local\Temp\7fd2e1c7ef6dbf84951a08ea1861458c691fd553dc93564c765436a9932d5c9e.exe
"C:\Users\Admin\AppData\Local\Temp\7fd2e1c7ef6dbf84951a08ea1861458c691fd553dc93564c765436a9932d5c9e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 172
  2⤵
  - Program crash
  PID:1252

memory/2040-54-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2040-55-0x0000000075991000-0x0000000075993000-memory.dmp

Filesize
8KB

Download
memory/2040-57-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download