be4a19b2e0b00e9abebee7a432a822947a35e53360089699cd605590236a4b0f

Analysis

max time kernel
38s
max time network
180s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 01:58

Target

be4a19b2e0b00e9abebee7a432a822947a35e53360089699cd605590236a4b0f.exe
Size

204KB
MD5

986e70fff4dc699e074718926941ea3a
SHA1

9f591cc7985dbe956b7c5dc1c83ee53251358b3d
SHA256

be4a19b2e0b00e9abebee7a432a822947a35e53360089699cd605590236a4b0f
SHA512

92bc3c27f75173956dc9d6df4c9a2d05b879d50883d29a8ddfe5af072b3b750d6d379754dc92755b2fa4870b8b4d1edbee649e890851aefd4dac161212ca9e75
SSDEEP

3072:5ePgEctxGv4QcU9KQ2BBA2waPxItmoli:VEctxGsWKQ2Bx5xQu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
560	1880	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 560	1880	be4a19b2e0b00e9abebee7a432a822947a35e53360089699cd605590236a4b0f.exe	28
PID 1880 wrote to memory of 560	1880	be4a19b2e0b00e9abebee7a432a822947a35e53360089699cd605590236a4b0f.exe	28
PID 1880 wrote to memory of 560	1880	be4a19b2e0b00e9abebee7a432a822947a35e53360089699cd605590236a4b0f.exe	28
PID 1880 wrote to memory of 560	1880	be4a19b2e0b00e9abebee7a432a822947a35e53360089699cd605590236a4b0f.exe	28

C:\Users\Admin\AppData\Local\Temp\be4a19b2e0b00e9abebee7a432a822947a35e53360089699cd605590236a4b0f.exe
"C:\Users\Admin\AppData\Local\Temp\be4a19b2e0b00e9abebee7a432a822947a35e53360089699cd605590236a4b0f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 124
  2⤵
  - Program crash
  PID:560

memory/1880-54-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download