978eff652f958c08d27cb687fd2e018d00004ea5f593af7c92fa7908648c9abc

Analysis

max time kernel
24s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 09:40

Target

978eff652f958c08d27cb687fd2e018d00004ea5f593af7c92fa7908648c9abc.exe
Size

76KB
MD5

6b539d6e1e8ba2f6a8f439eb96c7583e
SHA1

926d8bef8fd1d70f513b84ca6bd7a99b4579c4c9
SHA256

978eff652f958c08d27cb687fd2e018d00004ea5f593af7c92fa7908648c9abc
SHA512

a0dc03b9fb2c3098663f88b798d76472ae503a78b2be9865d054db22071835ea98e52418323934123db6fd9f8923e4a59ab591bb53c312b15a48f4bc241c9d74
SSDEEP

1536:0DDDDTAaDnPedwkL++zp0wUvkQITH+xXtAI71S6ppjVrs2ryrd1vUQuq6:BaDnPeuDlrvkQTxTSUHs2qo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1380	1648	WerFault.exe	19

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 1380	1648	978eff652f958c08d27cb687fd2e018d00004ea5f593af7c92fa7908648c9abc.exe	28
PID 1648 wrote to memory of 1380	1648	978eff652f958c08d27cb687fd2e018d00004ea5f593af7c92fa7908648c9abc.exe	28
PID 1648 wrote to memory of 1380	1648	978eff652f958c08d27cb687fd2e018d00004ea5f593af7c92fa7908648c9abc.exe	28
PID 1648 wrote to memory of 1380	1648	978eff652f958c08d27cb687fd2e018d00004ea5f593af7c92fa7908648c9abc.exe	28

C:\Users\Admin\AppData\Local\Temp\978eff652f958c08d27cb687fd2e018d00004ea5f593af7c92fa7908648c9abc.exe
"C:\Users\Admin\AppData\Local\Temp\978eff652f958c08d27cb687fd2e018d00004ea5f593af7c92fa7908648c9abc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 36
  2⤵
  - Program crash
  PID:1380

memory/1648-55-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download