b72d06094cf3541578ad59dbfcd7fdec964917231ab2aecd7330101a03c3b2a8

Analysis

max time kernel
81s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 08:02

Target

b72d06094cf3541578ad59dbfcd7fdec964917231ab2aecd7330101a03c3b2a8.exe
Size

20KB
MD5

983c0891bb915427960464b4d1c74efa
SHA1

21bd7d2324be1488febff6653a1c10477e80f2bd
SHA256

b72d06094cf3541578ad59dbfcd7fdec964917231ab2aecd7330101a03c3b2a8
SHA512

b558d81517673b20415fe8461b61545d4b638232df155a1dd43e00da935cbd2f6957d6cb83e5a7058a2f24a5169de72d345095195c14db3b12cd060e2e3724c9
SSDEEP

24:w6MUpOBvu7OLeRqw/Ss+Zr+ZBI/lzW8kksiz1py8kobIIdzX/v3HoQ9xT4:/3wBGxqw/Ss+ZrqItGitnLX/HT4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
612	1916	WerFault.exe	20

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 612	1916	b72d06094cf3541578ad59dbfcd7fdec964917231ab2aecd7330101a03c3b2a8.exe	28
PID 1916 wrote to memory of 612	1916	b72d06094cf3541578ad59dbfcd7fdec964917231ab2aecd7330101a03c3b2a8.exe	28
PID 1916 wrote to memory of 612	1916	b72d06094cf3541578ad59dbfcd7fdec964917231ab2aecd7330101a03c3b2a8.exe	28
PID 1916 wrote to memory of 612	1916	b72d06094cf3541578ad59dbfcd7fdec964917231ab2aecd7330101a03c3b2a8.exe	28

C:\Users\Admin\AppData\Local\Temp\b72d06094cf3541578ad59dbfcd7fdec964917231ab2aecd7330101a03c3b2a8.exe
"C:\Users\Admin\AppData\Local\Temp\b72d06094cf3541578ad59dbfcd7fdec964917231ab2aecd7330101a03c3b2a8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 88
  2⤵
  - Program crash
  PID:612

memory/1916-54-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download