c7ea1679ad201387f6155872f19983440263a68103038e3946e47aca8da00d96

Analysis

max time kernel
28s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 02:22

Target

c7ea1679ad201387f6155872f19983440263a68103038e3946e47aca8da00d96.exe
Size

64KB
MD5

4cdbdb022801345d08ca551382823bb7
SHA1

7f5d7104c5fa7aff0dfa19d4a9ed1b875447a90f
SHA256

c7ea1679ad201387f6155872f19983440263a68103038e3946e47aca8da00d96
SHA512

66c2b40a173e5ab05a4454943a873ae7dbe9743acde2a69c726de86666250bdbe3e8e347e05a2d38f899242fe624aef8316f6c1e5217535dd9f34452b23bc1fb
SSDEEP

768:j8m1Sq4NQErBsH1tzoisBKQI6dObAG/dqOXHsoAx5JXrUq/6Y7C+KnA+7PoNw8fA:bsq+QV4rObAdNoAf5UqyYe/ArNw8bo7T

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
528	892	WerFault.exe	18

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 528	892	c7ea1679ad201387f6155872f19983440263a68103038e3946e47aca8da00d96.exe	27
PID 892 wrote to memory of 528	892	c7ea1679ad201387f6155872f19983440263a68103038e3946e47aca8da00d96.exe	27
PID 892 wrote to memory of 528	892	c7ea1679ad201387f6155872f19983440263a68103038e3946e47aca8da00d96.exe	27
PID 892 wrote to memory of 528	892	c7ea1679ad201387f6155872f19983440263a68103038e3946e47aca8da00d96.exe	27

C:\Users\Admin\AppData\Local\Temp\c7ea1679ad201387f6155872f19983440263a68103038e3946e47aca8da00d96.exe
"C:\Users\Admin\AppData\Local\Temp\c7ea1679ad201387f6155872f19983440263a68103038e3946e47aca8da00d96.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 892 -s 160
  2⤵
  - Program crash
  PID:528

memory/528-55-0x0000000000000000-mapping.dmp

Download
memory/892-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download