f96e435e7f9bcdcfafff4b5b61c92b9ce7006da9ad73387654d8a0946d0ec9d7

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 10:57

Target

f96e435e7f9bcdcfafff4b5b61c92b9ce7006da9ad73387654d8a0946d0ec9d7.exe
Size

74KB
MD5

41e65b229f701cc249284b6eab974865
SHA1

77e7211dd9eaf67a86899b635ece3b3741100697
SHA256

f96e435e7f9bcdcfafff4b5b61c92b9ce7006da9ad73387654d8a0946d0ec9d7
SHA512

17ae984345499842bc7332aa055115cce8ebadf88a8209fb4a87fcc7bf9119262261a84c8061766daa5ba0fbc3904be0b0f01fc948ce6bd1e3e49b48c4d7258d
SSDEEP

1536:Ssikblh4WLb5oW9FnDH+fApdpTBvHir6aOvJ3zhB1Eq:GkblbLdo0DH+fKdp5Hy6a0z6q

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1932	1764	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 1932	1764	f96e435e7f9bcdcfafff4b5b61c92b9ce7006da9ad73387654d8a0946d0ec9d7.exe	28
PID 1764 wrote to memory of 1932	1764	f96e435e7f9bcdcfafff4b5b61c92b9ce7006da9ad73387654d8a0946d0ec9d7.exe	28
PID 1764 wrote to memory of 1932	1764	f96e435e7f9bcdcfafff4b5b61c92b9ce7006da9ad73387654d8a0946d0ec9d7.exe	28
PID 1764 wrote to memory of 1932	1764	f96e435e7f9bcdcfafff4b5b61c92b9ce7006da9ad73387654d8a0946d0ec9d7.exe	28

C:\Users\Admin\AppData\Local\Temp\f96e435e7f9bcdcfafff4b5b61c92b9ce7006da9ad73387654d8a0946d0ec9d7.exe
"C:\Users\Admin\AppData\Local\Temp\f96e435e7f9bcdcfafff4b5b61c92b9ce7006da9ad73387654d8a0946d0ec9d7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 140
  2⤵
  - Program crash
  PID:1932

memory/1764-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download
memory/1764-56-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download