639a79231f4cb55370a481cedd61307afe10bd98b63ba330f44420da0378f220

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 04:21

Target

639a79231f4cb55370a481cedd61307afe10bd98b63ba330f44420da0378f220.exe
Size

96KB
MD5

d091efea1bbde0fdafa0cd3cf5273b72
SHA1

865307e6d03cb92bfebc47e245744b2f3245b927
SHA256

639a79231f4cb55370a481cedd61307afe10bd98b63ba330f44420da0378f220
SHA512

95ba09928e7bdf8a1cf3f68f21da9ef3c3aa05184e0d151e762a3c58df90a334dae8e2e215b6f47f3f8e9a33187d6f43d3910cf7a00a72dcce5dcf5a74c36f02
SSDEEP

768:d06R0UKzOgnKqGR7//GPc0LOBhvBrHks3IiyhDYQbGmxlNaM+WGa1wuxnzgOYw9f:7R0vxn3Pc0LCH9MtbvabUDzJYWu3Bg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
960	1968	WerFault.exe	21

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 960	1968	639a79231f4cb55370a481cedd61307afe10bd98b63ba330f44420da0378f220.exe	27
PID 1968 wrote to memory of 960	1968	639a79231f4cb55370a481cedd61307afe10bd98b63ba330f44420da0378f220.exe	27
PID 1968 wrote to memory of 960	1968	639a79231f4cb55370a481cedd61307afe10bd98b63ba330f44420da0378f220.exe	27
PID 1968 wrote to memory of 960	1968	639a79231f4cb55370a481cedd61307afe10bd98b63ba330f44420da0378f220.exe	27

C:\Users\Admin\AppData\Local\Temp\639a79231f4cb55370a481cedd61307afe10bd98b63ba330f44420da0378f220.exe
"C:\Users\Admin\AppData\Local\Temp\639a79231f4cb55370a481cedd61307afe10bd98b63ba330f44420da0378f220.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 156
  2⤵
  - Program crash
  PID:960

memory/1968-54-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/1968-55-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download