864cbb3cbbea52b6af69f75d515ec4e0b9c3548c75e8349f7260d81511e1a37d

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 00:26

Target

864cbb3cbbea52b6af69f75d515ec4e0b9c3548c75e8349f7260d81511e1a37d.exe
Size

143KB
MD5

4b4326bf46b1b510ff7bc50ad96e7d74
SHA1

369e40f3e7b87b9eebdc71590a1c28469a9e6112
SHA256

864cbb3cbbea52b6af69f75d515ec4e0b9c3548c75e8349f7260d81511e1a37d
SHA512

456238502a4ea6710b279776fbbf66346bec3aebb38129228d3a40f320d904433041fec0888546ed72d88da17a1d0d970f36f3b3ab50187e06c8cd3380f51955
SSDEEP

1536:IR0In3Pc0LCH9MtbvabUDzJYWu3BGI5juMlXyUEu02fk:IRTn3k0CdM1vabyzJYWqn3E92fk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1356	852	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 1356	852	864cbb3cbbea52b6af69f75d515ec4e0b9c3548c75e8349f7260d81511e1a37d.exe	27
PID 852 wrote to memory of 1356	852	864cbb3cbbea52b6af69f75d515ec4e0b9c3548c75e8349f7260d81511e1a37d.exe	27
PID 852 wrote to memory of 1356	852	864cbb3cbbea52b6af69f75d515ec4e0b9c3548c75e8349f7260d81511e1a37d.exe	27
PID 852 wrote to memory of 1356	852	864cbb3cbbea52b6af69f75d515ec4e0b9c3548c75e8349f7260d81511e1a37d.exe	27

C:\Users\Admin\AppData\Local\Temp\864cbb3cbbea52b6af69f75d515ec4e0b9c3548c75e8349f7260d81511e1a37d.exe
"C:\Users\Admin\AppData\Local\Temp\864cbb3cbbea52b6af69f75d515ec4e0b9c3548c75e8349f7260d81511e1a37d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 852 -s 156
  2⤵
  - Program crash
  PID:1356

memory/852-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/852-56-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download