b746eedb8161a51b96653f42a45af453cff7524d49edc74a034bcb5f352d5f98

Analysis

max time kernel
211s
max time network
333s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 06:45

Target

b746eedb8161a51b96653f42a45af453cff7524d49edc74a034bcb5f352d5f98.exe
Size

192KB
MD5

317f393c92d0a500877434072e33a8a9
SHA1

6cca72e153d7bec9e5dd21f683df2c95934b4a7d
SHA256

b746eedb8161a51b96653f42a45af453cff7524d49edc74a034bcb5f352d5f98
SHA512

283dd9d4bb31d2caa8f2139ca84fe4e4d1eba1c21999231ce33a795e2c37647ec0844de26feb832c5a7a99646a7c920d0f6d414733cedc84f73dd31be02b83bd
SSDEEP

768:A/dno9CiorO8KhlKWhRHycITlAI1hGqrIfxQHp6++gL4h9AwlvtafEyuwPiQHttq:A+ksKWfy9TlHbjHoBhJttaMypPlq8rT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
568	1240	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 568	1240	b746eedb8161a51b96653f42a45af453cff7524d49edc74a034bcb5f352d5f98.exe	28
PID 1240 wrote to memory of 568	1240	b746eedb8161a51b96653f42a45af453cff7524d49edc74a034bcb5f352d5f98.exe	28
PID 1240 wrote to memory of 568	1240	b746eedb8161a51b96653f42a45af453cff7524d49edc74a034bcb5f352d5f98.exe	28
PID 1240 wrote to memory of 568	1240	b746eedb8161a51b96653f42a45af453cff7524d49edc74a034bcb5f352d5f98.exe	28

C:\Users\Admin\AppData\Local\Temp\b746eedb8161a51b96653f42a45af453cff7524d49edc74a034bcb5f352d5f98.exe
"C:\Users\Admin\AppData\Local\Temp\b746eedb8161a51b96653f42a45af453cff7524d49edc74a034bcb5f352d5f98.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 96
  2⤵
  - Program crash
  PID:568

memory/1240-55-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download