94f976a5cc0f1fc631a01b3f21dbc027437f87b56a718cea95d2079bcf2e019d

Analysis

max time kernel
16s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 20:56

Target

94f976a5cc0f1fc631a01b3f21dbc027437f87b56a718cea95d2079bcf2e019d.exe
Size

48KB
MD5

fe254bc402b9e2a72b0595a6217a7db9
SHA1

b0681d7223dc3e32adbb5f0a22dcb4731126161f
SHA256

94f976a5cc0f1fc631a01b3f21dbc027437f87b56a718cea95d2079bcf2e019d
SHA512

e0d82eecabf8dd64e3bd028ab350ff3bb9603be927d3435d911a420c1ba4643dadffa3df44c0ec92c945e4b1e43a26de5f166167382ff7aee1454f3eec98220f
SSDEEP

768:PtiELW99io7orFdlMX967ZvSTL/Dx9BvMEWSD5VCGHFSJWWoNFrLH2s09yS4:PtiIc45dlMN6tSv19BvsSD/CQSJurLWG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1188	1648	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 1188	1648	94f976a5cc0f1fc631a01b3f21dbc027437f87b56a718cea95d2079bcf2e019d.exe	28
PID 1648 wrote to memory of 1188	1648	94f976a5cc0f1fc631a01b3f21dbc027437f87b56a718cea95d2079bcf2e019d.exe	28
PID 1648 wrote to memory of 1188	1648	94f976a5cc0f1fc631a01b3f21dbc027437f87b56a718cea95d2079bcf2e019d.exe	28
PID 1648 wrote to memory of 1188	1648	94f976a5cc0f1fc631a01b3f21dbc027437f87b56a718cea95d2079bcf2e019d.exe	28

C:\Users\Admin\AppData\Local\Temp\94f976a5cc0f1fc631a01b3f21dbc027437f87b56a718cea95d2079bcf2e019d.exe
"C:\Users\Admin\AppData\Local\Temp\94f976a5cc0f1fc631a01b3f21dbc027437f87b56a718cea95d2079bcf2e019d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 96
  2⤵
  - Program crash
  PID:1188

memory/1648-54-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download