15fdb77be216db4139820dde76133bdf24f620610ed58418a9be2bbaa7bee466

Analysis

max time kernel
46s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 09:53

Target

15fdb77be216db4139820dde76133bdf24f620610ed58418a9be2bbaa7bee466.exe
Size

63KB
MD5

4ee22ea61fce1d6c6a867600daf5ea10
SHA1

e67cc50520387bdf2a9ce45a2b012e474d2e0e5a
SHA256

15fdb77be216db4139820dde76133bdf24f620610ed58418a9be2bbaa7bee466
SHA512

966774fcd258f7491caf265dd94bd5e75df959581166de2fa61aba196dc485de0b1b71ca347cf5181caab06bf49d0f74f4b2b0679ec70e583a9a4f5d7430918e
SSDEEP

1536:L+bjOnHg4cnCawt2Ac+wAztIzPhpphfCTckHS8wexbYi+kCKjbQp:6HOHECaw9c3AKb/fCTdH3JxbLvQp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1524	1288	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 1524	1288	15fdb77be216db4139820dde76133bdf24f620610ed58418a9be2bbaa7bee466.exe	27
PID 1288 wrote to memory of 1524	1288	15fdb77be216db4139820dde76133bdf24f620610ed58418a9be2bbaa7bee466.exe	27
PID 1288 wrote to memory of 1524	1288	15fdb77be216db4139820dde76133bdf24f620610ed58418a9be2bbaa7bee466.exe	27
PID 1288 wrote to memory of 1524	1288	15fdb77be216db4139820dde76133bdf24f620610ed58418a9be2bbaa7bee466.exe	27

C:\Users\Admin\AppData\Local\Temp\15fdb77be216db4139820dde76133bdf24f620610ed58418a9be2bbaa7bee466.exe
"C:\Users\Admin\AppData\Local\Temp\15fdb77be216db4139820dde76133bdf24f620610ed58418a9be2bbaa7bee466.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 36
  2⤵
  - Program crash
  PID:1524

memory/1288-55-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download