137174ab717fa2a42e9b13cf04ff535d4b4f2649500965f9a4970efe3c5fafbb

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 00:52

Target

137174ab717fa2a42e9b13cf04ff535d4b4f2649500965f9a4970efe3c5fafbb.exe
Size

92KB
MD5

39826b5b031dddb197656fbda4ca6620
SHA1

3ab2ddc226203ebb5a849385ed8951c21694da00
SHA256

137174ab717fa2a42e9b13cf04ff535d4b4f2649500965f9a4970efe3c5fafbb
SHA512

ab5c090438123f7f44751414c9ebbf0d8111a3f3cd3a62111125406ca5a0e6d97eb0375aeeef83d7cb594371ed523986e5a4328290409fe8d4f61990711e9049
SSDEEP

24:yK9MtDiCvZFelGuIEd4jK9MtDiCvZFel8OVIHjK9MtDiCvZFel8OVIH:/9Mdis9qJ9MdisUL9MdisU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1680	1372	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 1680	1372	137174ab717fa2a42e9b13cf04ff535d4b4f2649500965f9a4970efe3c5fafbb.exe	28
PID 1372 wrote to memory of 1680	1372	137174ab717fa2a42e9b13cf04ff535d4b4f2649500965f9a4970efe3c5fafbb.exe	28
PID 1372 wrote to memory of 1680	1372	137174ab717fa2a42e9b13cf04ff535d4b4f2649500965f9a4970efe3c5fafbb.exe	28
PID 1372 wrote to memory of 1680	1372	137174ab717fa2a42e9b13cf04ff535d4b4f2649500965f9a4970efe3c5fafbb.exe	28

C:\Users\Admin\AppData\Local\Temp\137174ab717fa2a42e9b13cf04ff535d4b4f2649500965f9a4970efe3c5fafbb.exe
"C:\Users\Admin\AppData\Local\Temp\137174ab717fa2a42e9b13cf04ff535d4b4f2649500965f9a4970efe3c5fafbb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 36
  2⤵
  - Program crash
  PID:1680