f3f03e763012d5d715b39c217d030fed9e4738065afca2b1152bff48a934890c

Analysis

max time kernel
35s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 21:28

Target

f3f03e763012d5d715b39c217d030fed9e4738065afca2b1152bff48a934890c.exe
Size

106KB
MD5

f515bf35833ab033df73cb523be38fef
SHA1

45ce48015a68db54a9eec3817033af81425d9598
SHA256

f3f03e763012d5d715b39c217d030fed9e4738065afca2b1152bff48a934890c
SHA512

9da394a56e28a3c4c97dd397e49cb0ee7cb77f26135cbf51002a14df4d01469877b2481c3d7db48240386cc9ebf3312d7a60cf77fb47616448d4909ec55291a0
SSDEEP

1536:B+FDoKtniY1u7Nn2JFkC2styJjCKICFjC7EWisS+5mlatSfkZYX:B+FDzK71QkbstyJjCKICpC72s/mlaXC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
536	1888	WerFault.exe	18

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 536	1888	f3f03e763012d5d715b39c217d030fed9e4738065afca2b1152bff48a934890c.exe	28
PID 1888 wrote to memory of 536	1888	f3f03e763012d5d715b39c217d030fed9e4738065afca2b1152bff48a934890c.exe	28
PID 1888 wrote to memory of 536	1888	f3f03e763012d5d715b39c217d030fed9e4738065afca2b1152bff48a934890c.exe	28
PID 1888 wrote to memory of 536	1888	f3f03e763012d5d715b39c217d030fed9e4738065afca2b1152bff48a934890c.exe	28

C:\Users\Admin\AppData\Local\Temp\f3f03e763012d5d715b39c217d030fed9e4738065afca2b1152bff48a934890c.exe
"C:\Users\Admin\AppData\Local\Temp\f3f03e763012d5d715b39c217d030fed9e4738065afca2b1152bff48a934890c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 128
  2⤵
  - Program crash
  PID:536

memory/1888-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download