7377c6aab42bc0bcfa548de5394b32ffebd6da6dd4bb565221c14b49bb7835b3

Analysis

max time kernel
64s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 07:33

Target

7377c6aab42bc0bcfa548de5394b32ffebd6da6dd4bb565221c14b49bb7835b3.exe
Size

32KB
MD5

0972886dda1ed3796a03fa1896b1b15e
SHA1

9db5e2100f1e8d7b8204b686ca7d4799d8d0ef09
SHA256

7377c6aab42bc0bcfa548de5394b32ffebd6da6dd4bb565221c14b49bb7835b3
SHA512

7c4cc1c33b84e62b206137d15476ca196ee2fa520d64ecd717038d649b0e98db97b4f46d0dcb2d5c743f0cf5835d4ba3042d39d7345424bc50bfbe39f8144113
SSDEEP

768:cj90v2+zWL5ZSiS8OOXGdmZ/Kj1K/LXum9H3ieAs8slF91Z1hx:cj90uL5TS8OOXWmB8cDum4s8slLB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1120	1484	WerFault.exe	18

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 1120	1484	7377c6aab42bc0bcfa548de5394b32ffebd6da6dd4bb565221c14b49bb7835b3.exe	28
PID 1484 wrote to memory of 1120	1484	7377c6aab42bc0bcfa548de5394b32ffebd6da6dd4bb565221c14b49bb7835b3.exe	28
PID 1484 wrote to memory of 1120	1484	7377c6aab42bc0bcfa548de5394b32ffebd6da6dd4bb565221c14b49bb7835b3.exe	28
PID 1484 wrote to memory of 1120	1484	7377c6aab42bc0bcfa548de5394b32ffebd6da6dd4bb565221c14b49bb7835b3.exe	28

C:\Users\Admin\AppData\Local\Temp\7377c6aab42bc0bcfa548de5394b32ffebd6da6dd4bb565221c14b49bb7835b3.exe
"C:\Users\Admin\AppData\Local\Temp\7377c6aab42bc0bcfa548de5394b32ffebd6da6dd4bb565221c14b49bb7835b3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 88
  2⤵
  - Program crash
  PID:1120

memory/1120-55-0x0000000000000000-mapping.dmp

Download
memory/1484-54-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download