fa98c0f2557b92d1342ec9d9e5f096bd1e4aa7cbf8a250e5267728a941c51269

Analysis

max time kernel
28s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 03:48

Target

fa98c0f2557b92d1342ec9d9e5f096bd1e4aa7cbf8a250e5267728a941c51269.exe
Size

60KB
MD5

5edc7ffccb4c3adc1b806bb071ddf026
SHA1

d1b42459e009f1d9a4a8af5e035f0db269560a99
SHA256

fa98c0f2557b92d1342ec9d9e5f096bd1e4aa7cbf8a250e5267728a941c51269
SHA512

cb9510062bc4345c33d770cfbc90d55c9451025f538932542dcac74e4a750b185481c4886ce6ff2c9c0e5e162dc460ebb05d2542626bf5656a6ea9087eb2baba
SSDEEP

768:hMy63hSvQZN4LQu56PgJnmGrH4F+2PVsUPRwTRJtoFq:2SVRU4pm4tcVs9toFq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1400	1992	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1400	1992	fa98c0f2557b92d1342ec9d9e5f096bd1e4aa7cbf8a250e5267728a941c51269.exe	28
PID 1992 wrote to memory of 1400	1992	fa98c0f2557b92d1342ec9d9e5f096bd1e4aa7cbf8a250e5267728a941c51269.exe	28
PID 1992 wrote to memory of 1400	1992	fa98c0f2557b92d1342ec9d9e5f096bd1e4aa7cbf8a250e5267728a941c51269.exe	28
PID 1992 wrote to memory of 1400	1992	fa98c0f2557b92d1342ec9d9e5f096bd1e4aa7cbf8a250e5267728a941c51269.exe	28

C:\Users\Admin\AppData\Local\Temp\fa98c0f2557b92d1342ec9d9e5f096bd1e4aa7cbf8a250e5267728a941c51269.exe
"C:\Users\Admin\AppData\Local\Temp\fa98c0f2557b92d1342ec9d9e5f096bd1e4aa7cbf8a250e5267728a941c51269.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 120
  2⤵
  - Program crash
  PID:1400

memory/1992-54-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download