73d4020c03a2df9cd682ddf28341f72ba60d0caf83671c99e24d9d36a80cb332

Analysis

max time kernel
39s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 18:25

Target

73d4020c03a2df9cd682ddf28341f72ba60d0caf83671c99e24d9d36a80cb332.exe
Size

106KB
MD5

4cffa4a7b1d79faf6cf05e42bb3ff3cb
SHA1

1efcb4882f9da8d1f2469f3dc95b6af30cdcb951
SHA256

73d4020c03a2df9cd682ddf28341f72ba60d0caf83671c99e24d9d36a80cb332
SHA512

a74bb604ce399b2d5cbde464d466b2a95e74926b544a152c5aa4fdae244e425cf43a4e4c58b86dc98d0a7a1e1006549384b2e87e0c59682965f881ecd9838f12
SSDEEP

1536:8voTb+gkFyLdfgrYGWPAj1Oky8+aHZZKfOxFEnv2yAXYrIhCuwPcQ1Ok+3dFshFW:8vub+gzmYGW4j5y1I/EnwYmCuBddOUl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1544	340	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 340 wrote to memory of 1544	340	73d4020c03a2df9cd682ddf28341f72ba60d0caf83671c99e24d9d36a80cb332.exe	28
PID 340 wrote to memory of 1544	340	73d4020c03a2df9cd682ddf28341f72ba60d0caf83671c99e24d9d36a80cb332.exe	28
PID 340 wrote to memory of 1544	340	73d4020c03a2df9cd682ddf28341f72ba60d0caf83671c99e24d9d36a80cb332.exe	28
PID 340 wrote to memory of 1544	340	73d4020c03a2df9cd682ddf28341f72ba60d0caf83671c99e24d9d36a80cb332.exe	28

C:\Users\Admin\AppData\Local\Temp\73d4020c03a2df9cd682ddf28341f72ba60d0caf83671c99e24d9d36a80cb332.exe
"C:\Users\Admin\AppData\Local\Temp\73d4020c03a2df9cd682ddf28341f72ba60d0caf83671c99e24d9d36a80cb332.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 340 -s 152
  2⤵
  - Program crash
  PID:1544

memory/340-55-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download