62409a8cd9a41a301ceb68c61d83f127b9b92bd17d4cb6dd335409d143bb82c5

Analysis

max time kernel
14s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 03:58

Target

62409a8cd9a41a301ceb68c61d83f127b9b92bd17d4cb6dd335409d143bb82c5.exe
Size

60KB
MD5

edf1a87c5c95ea2e6003ef120d74efb8
SHA1

2af9cac305dd8084017ac00cf3b426f8e883efd9
SHA256

62409a8cd9a41a301ceb68c61d83f127b9b92bd17d4cb6dd335409d143bb82c5
SHA512

abaa22c4b51abe66b7f126979fb2812a7884f31082993d76e67c9291adb9b085e2e8b7d9e59966b2bc47815d30bd9c59b6ea6b89b8d199edcd3c55a3e3f156b2
SSDEEP

1536:5hoW+94yqtjD72ioFl4Qx/IUFN6STGvJSmU8roaFlrQAGEP:5hK9L2W/1SSTuvn3rMEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
688	1880	WerFault.exe	11

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 688	1880	62409a8cd9a41a301ceb68c61d83f127b9b92bd17d4cb6dd335409d143bb82c5.exe	28
PID 1880 wrote to memory of 688	1880	62409a8cd9a41a301ceb68c61d83f127b9b92bd17d4cb6dd335409d143bb82c5.exe	28
PID 1880 wrote to memory of 688	1880	62409a8cd9a41a301ceb68c61d83f127b9b92bd17d4cb6dd335409d143bb82c5.exe	28
PID 1880 wrote to memory of 688	1880	62409a8cd9a41a301ceb68c61d83f127b9b92bd17d4cb6dd335409d143bb82c5.exe	28

C:\Users\Admin\AppData\Local\Temp\62409a8cd9a41a301ceb68c61d83f127b9b92bd17d4cb6dd335409d143bb82c5.exe
"C:\Users\Admin\AppData\Local\Temp\62409a8cd9a41a301ceb68c61d83f127b9b92bd17d4cb6dd335409d143bb82c5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 96
  2⤵
  - Program crash
  PID:688

memory/1880-55-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download