f6bd4e3522715bd539365983a625738bcb50eae092213662b0505700f4c80824

Analysis

max time kernel
70s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 02:07

Target

f6bd4e3522715bd539365983a625738bcb50eae092213662b0505700f4c80824.exe
Size

28KB
MD5

135022755d6c7c05215bd48f9af50d7c
SHA1

7745e02b8002746fef023fe3ffc5212934490371
SHA256

f6bd4e3522715bd539365983a625738bcb50eae092213662b0505700f4c80824
SHA512

54c5344523382fe5403f87dc640c04ac60503ec125f484b55acccfca2d1b4d0d4c234cf0d907e6990247d71ae47c2820d5c674c5bcd170f696e091c30abec6db
SSDEEP

768:il8B1yDWN11WNllvbMf2HgnsxzHoMY3wK3HX2Rtl:1WCN7WNllYfVWHotwK3Hel

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1992	2000	WerFault.exe	18

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1992	2000	f6bd4e3522715bd539365983a625738bcb50eae092213662b0505700f4c80824.exe	28
PID 2000 wrote to memory of 1992	2000	f6bd4e3522715bd539365983a625738bcb50eae092213662b0505700f4c80824.exe	28
PID 2000 wrote to memory of 1992	2000	f6bd4e3522715bd539365983a625738bcb50eae092213662b0505700f4c80824.exe	28
PID 2000 wrote to memory of 1992	2000	f6bd4e3522715bd539365983a625738bcb50eae092213662b0505700f4c80824.exe	28

C:\Users\Admin\AppData\Local\Temp\f6bd4e3522715bd539365983a625738bcb50eae092213662b0505700f4c80824.exe
"C:\Users\Admin\AppData\Local\Temp\f6bd4e3522715bd539365983a625738bcb50eae092213662b0505700f4c80824.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 88
  2⤵
  - Program crash
  PID:1992

memory/2000-55-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download