c832f1ec667ccb1f4374319d22bfcfb059403a00ff5822b1fc66806aed28c47e

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 06:30

Target

c832f1ec667ccb1f4374319d22bfcfb059403a00ff5822b1fc66806aed28c47e.exe
Size

74KB
MD5

526916b98fc0330c4ffd621116eaf5d5
SHA1

f8fd90a2d3cf9a2bf69b7ee0355a4dcfab757518
SHA256

c832f1ec667ccb1f4374319d22bfcfb059403a00ff5822b1fc66806aed28c47e
SHA512

44561e3fdf78dd9a5b0c2eeef0a2e5b707ab003ba2c50233ec89e3db7b30a7bb039321ef466d6de458145344228a73e2d439910ebd8cda412a98624ab32d5a8f
SSDEEP

1536:Pqm9idWTydRnBQUKuWWeFokRGbvtaJTA+Vh4x2qmDN+nieAYmNemS0Z:PpYIkQUK3X+GGbvsTACWwvDN/eAYmrSm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
548	112	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 112 wrote to memory of 548	112	c832f1ec667ccb1f4374319d22bfcfb059403a00ff5822b1fc66806aed28c47e.exe	27
PID 112 wrote to memory of 548	112	c832f1ec667ccb1f4374319d22bfcfb059403a00ff5822b1fc66806aed28c47e.exe	27
PID 112 wrote to memory of 548	112	c832f1ec667ccb1f4374319d22bfcfb059403a00ff5822b1fc66806aed28c47e.exe	27
PID 112 wrote to memory of 548	112	c832f1ec667ccb1f4374319d22bfcfb059403a00ff5822b1fc66806aed28c47e.exe	27

C:\Users\Admin\AppData\Local\Temp\c832f1ec667ccb1f4374319d22bfcfb059403a00ff5822b1fc66806aed28c47e.exe
"C:\Users\Admin\AppData\Local\Temp\c832f1ec667ccb1f4374319d22bfcfb059403a00ff5822b1fc66806aed28c47e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 112 -s 116
  2⤵
  - Program crash
  PID:548

memory/112-54-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download
memory/112-55-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download