974d6c959b31c55559eeb50dc10d5a57d5883c96497bac3832e248fb4e6d6b28

Analysis

max time kernel
10s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 07:30

Target

974d6c959b31c55559eeb50dc10d5a57d5883c96497bac3832e248fb4e6d6b28.exe
Size

24KB
MD5

17977465026ec6d63906a0f707addde0
SHA1

964a81ae68518a66951ac68e4dab325d58db564f
SHA256

974d6c959b31c55559eeb50dc10d5a57d5883c96497bac3832e248fb4e6d6b28
SHA512

235d40f03c761c1da234622fdeb85ad2ca0e22fe6a91a38f3bf4a49965456fa63bfa53fba05b8273bbb4928d935fa61274583c07a64ed69b5c512b4143a3089d
SSDEEP

96:Y5yOjnSBWk6l6Y4GmUssVlhewhTrRQzebYhFD0E7Vsw3hjJR423dYVwYRWo:Y59SBWTEMsU7z0rfF7FRjH2SYRWo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1732	1636	WerFault.exe	20

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1732	1636	974d6c959b31c55559eeb50dc10d5a57d5883c96497bac3832e248fb4e6d6b28.exe	27
PID 1636 wrote to memory of 1732	1636	974d6c959b31c55559eeb50dc10d5a57d5883c96497bac3832e248fb4e6d6b28.exe	27
PID 1636 wrote to memory of 1732	1636	974d6c959b31c55559eeb50dc10d5a57d5883c96497bac3832e248fb4e6d6b28.exe	27
PID 1636 wrote to memory of 1732	1636	974d6c959b31c55559eeb50dc10d5a57d5883c96497bac3832e248fb4e6d6b28.exe	27

C:\Users\Admin\AppData\Local\Temp\974d6c959b31c55559eeb50dc10d5a57d5883c96497bac3832e248fb4e6d6b28.exe
"C:\Users\Admin\AppData\Local\Temp\974d6c959b31c55559eeb50dc10d5a57d5883c96497bac3832e248fb4e6d6b28.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 88
  2⤵
  - Program crash
  PID:1732

memory/1636-55-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download