365f97b5999cf582c968a837a96035858b87f2e5b3c3d5b14446c936964f6bb3

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 10:43

Target

365f97b5999cf582c968a837a96035858b87f2e5b3c3d5b14446c936964f6bb3.exe
Size

27KB
MD5

99d071119b246eeb93cdebdbf870f932
SHA1

c82ea54f9011466584e115137dd37551d3ca9b44
SHA256

365f97b5999cf582c968a837a96035858b87f2e5b3c3d5b14446c936964f6bb3
SHA512

fb580cee205eec50d13b6f57faf5643449ec0eb5da5f9c7983bcb873cf5dde3cbe3083352f988aa99446504f2f0bee51eaeb0a32ed88a338cbc41302e73870c9
SSDEEP

768:WfLMhlzjNKiQWgdgmWhtaHxNZbR3Xe9lMF:WAzjNpngfsaHv3ee

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1156	1604	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 1156	1604	365f97b5999cf582c968a837a96035858b87f2e5b3c3d5b14446c936964f6bb3.exe	27
PID 1604 wrote to memory of 1156	1604	365f97b5999cf582c968a837a96035858b87f2e5b3c3d5b14446c936964f6bb3.exe	27
PID 1604 wrote to memory of 1156	1604	365f97b5999cf582c968a837a96035858b87f2e5b3c3d5b14446c936964f6bb3.exe	27
PID 1604 wrote to memory of 1156	1604	365f97b5999cf582c968a837a96035858b87f2e5b3c3d5b14446c936964f6bb3.exe	27

C:\Users\Admin\AppData\Local\Temp\365f97b5999cf582c968a837a96035858b87f2e5b3c3d5b14446c936964f6bb3.exe
"C:\Users\Admin\AppData\Local\Temp\365f97b5999cf582c968a837a96035858b87f2e5b3c3d5b14446c936964f6bb3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 36
  2⤵
  - Program crash
  PID:1156

memory/1604-55-0x0000000000400000-0x00000000004082A0-memory.dmp

Filesize
32KB

Download