f32b33ddbd363d3c43ac90bb66e04933b95510666deeb9f424cf161f32923c4e

Analysis

max time kernel
23s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 03:59

Target

f32b33ddbd363d3c43ac90bb66e04933b95510666deeb9f424cf161f32923c4e.exe
Size

557KB
MD5

3b25186b36992ffae7d0a92f4e6938d0
SHA1

d80105a44e24533a00c18db71b914b76ae0ca1f9
SHA256

f32b33ddbd363d3c43ac90bb66e04933b95510666deeb9f424cf161f32923c4e
SHA512

a2a41a787de4e9a2b073495a8863d641f631ece7102bb7fc1978e943a6c1439d1714278ca0736e768fc5aad4fb660830841a0bf02b49690668acc45262a44ea2
SSDEEP

12288:dGuNMMGcAlsI/5LRfHti+ZLXsuAa//e5I2cGBAAxP6:dV9G7GILRfHti+RcuAy/e5/BAAR6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2016	1340	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 2016	1340	f32b33ddbd363d3c43ac90bb66e04933b95510666deeb9f424cf161f32923c4e.exe	28
PID 1340 wrote to memory of 2016	1340	f32b33ddbd363d3c43ac90bb66e04933b95510666deeb9f424cf161f32923c4e.exe	28
PID 1340 wrote to memory of 2016	1340	f32b33ddbd363d3c43ac90bb66e04933b95510666deeb9f424cf161f32923c4e.exe	28
PID 1340 wrote to memory of 2016	1340	f32b33ddbd363d3c43ac90bb66e04933b95510666deeb9f424cf161f32923c4e.exe	28

C:\Users\Admin\AppData\Local\Temp\f32b33ddbd363d3c43ac90bb66e04933b95510666deeb9f424cf161f32923c4e.exe
"C:\Users\Admin\AppData\Local\Temp\f32b33ddbd363d3c43ac90bb66e04933b95510666deeb9f424cf161f32923c4e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 172
  2⤵
  - Program crash
  PID:2016

memory/1340-54-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/1340-56-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download