7e82f6e74b6d8d65e553bfae396962d35be558ab572f83c3b8b935ca5ba5b30a

Analysis

max time kernel
13s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 08:08

Target

7e82f6e74b6d8d65e553bfae396962d35be558ab572f83c3b8b935ca5ba5b30a.exe
Size

28KB
MD5

b61441828ebf857a1bdf15f42113e2a5
SHA1

0f316fe5d76f9fa304a6b0b862316b935a3590f2
SHA256

7e82f6e74b6d8d65e553bfae396962d35be558ab572f83c3b8b935ca5ba5b30a
SHA512

32a92abd47d515bff60f2ac1da4d4539d0180f3d88e41cbafbf2b3bd9f5e0a7d6184a8fc694c557ffb06685272b45fe23a26687fac87a38e54429a50bb45cd76
SSDEEP

768:lrS28jZkfQVSSKCPfPRlcl82qGKxcA7doW/b9wB:5u22SSDPxKe2RPA1yB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1872	1628	WerFault.exe	19

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1872	1628	7e82f6e74b6d8d65e553bfae396962d35be558ab572f83c3b8b935ca5ba5b30a.exe	27
PID 1628 wrote to memory of 1872	1628	7e82f6e74b6d8d65e553bfae396962d35be558ab572f83c3b8b935ca5ba5b30a.exe	27
PID 1628 wrote to memory of 1872	1628	7e82f6e74b6d8d65e553bfae396962d35be558ab572f83c3b8b935ca5ba5b30a.exe	27
PID 1628 wrote to memory of 1872	1628	7e82f6e74b6d8d65e553bfae396962d35be558ab572f83c3b8b935ca5ba5b30a.exe	27

C:\Users\Admin\AppData\Local\Temp\7e82f6e74b6d8d65e553bfae396962d35be558ab572f83c3b8b935ca5ba5b30a.exe
"C:\Users\Admin\AppData\Local\Temp\7e82f6e74b6d8d65e553bfae396962d35be558ab572f83c3b8b935ca5ba5b30a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 88
  2⤵
  - Program crash
  PID:1872

memory/1628-55-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download