c873ba7749c12b7820dc285d2a8efb9cfb10674c59161c07bbf0493d73f952ab

Analysis

max time kernel
36s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 01:22

Target

c873ba7749c12b7820dc285d2a8efb9cfb10674c59161c07bbf0493d73f952ab.exe
Size

94KB
MD5

5de6cfd27cbd7531bc58261c79913628
SHA1

0408320fae911dc352cfba048820d3f66761b754
SHA256

c873ba7749c12b7820dc285d2a8efb9cfb10674c59161c07bbf0493d73f952ab
SHA512

e07173bdf2a835b3b98f626035de8269ed07067b123dda4ce2e014627098c25e94aab05d82930464f59624a2972bd50807d50caf225fea86146e6d2b833695c0
SSDEEP

1536:vpSsDzcz31W2EYyS4oRuWJjwoRTBNlUUc8YaEJwZK4/83ZoMOALLbwTc:xS+AzlW2ExS5RuWJjwgphZEXtpxLLbCc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1948	1952	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 1948	1952	c873ba7749c12b7820dc285d2a8efb9cfb10674c59161c07bbf0493d73f952ab.exe	28
PID 1952 wrote to memory of 1948	1952	c873ba7749c12b7820dc285d2a8efb9cfb10674c59161c07bbf0493d73f952ab.exe	28
PID 1952 wrote to memory of 1948	1952	c873ba7749c12b7820dc285d2a8efb9cfb10674c59161c07bbf0493d73f952ab.exe	28
PID 1952 wrote to memory of 1948	1952	c873ba7749c12b7820dc285d2a8efb9cfb10674c59161c07bbf0493d73f952ab.exe	28

C:\Users\Admin\AppData\Local\Temp\c873ba7749c12b7820dc285d2a8efb9cfb10674c59161c07bbf0493d73f952ab.exe
"C:\Users\Admin\AppData\Local\Temp\c873ba7749c12b7820dc285d2a8efb9cfb10674c59161c07bbf0493d73f952ab.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 36
  2⤵
  - Program crash
  PID:1948

memory/1952-55-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download