b963a7c352d4880e69a46a7aa20312461bdcfd7fa5538293ba9348c54ede7396

Analysis

max time kernel
40s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 14:29

Target

b963a7c352d4880e69a46a7aa20312461bdcfd7fa5538293ba9348c54ede7396.exe
Size

215KB
MD5

785676023e9c45f35d534b837a86f5ff
SHA1

c7e2351317c61738b955efc662302e8ec26b8403
SHA256

b963a7c352d4880e69a46a7aa20312461bdcfd7fa5538293ba9348c54ede7396
SHA512

9c6fd779bd0a4071b82f43eeb0c2124d2eba3bd66a34bb2d257fc0c42110c487ea48f91ef70709473a9ff99d5005e1947796d5ec9a06699dcc1d4cd0a5580e0f
SSDEEP

3072:a+FDzK71QkbstyJjCKICpC72s/mlaX4Ehmo/heINnGe7UXDe0Vex:a+I713bstyJj0sC7/HH/h7dD7ZC8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1028	836	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 1028	836	b963a7c352d4880e69a46a7aa20312461bdcfd7fa5538293ba9348c54ede7396.exe	27
PID 836 wrote to memory of 1028	836	b963a7c352d4880e69a46a7aa20312461bdcfd7fa5538293ba9348c54ede7396.exe	27
PID 836 wrote to memory of 1028	836	b963a7c352d4880e69a46a7aa20312461bdcfd7fa5538293ba9348c54ede7396.exe	27
PID 836 wrote to memory of 1028	836	b963a7c352d4880e69a46a7aa20312461bdcfd7fa5538293ba9348c54ede7396.exe	27

C:\Users\Admin\AppData\Local\Temp\b963a7c352d4880e69a46a7aa20312461bdcfd7fa5538293ba9348c54ede7396.exe
"C:\Users\Admin\AppData\Local\Temp\b963a7c352d4880e69a46a7aa20312461bdcfd7fa5538293ba9348c54ede7396.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 124
  2⤵
  - Program crash
  PID:1028

memory/836-54-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download