b53836deb42539f9cf9210225054147163da19a25885f4cff5b315c76029eb2c

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 09:49

Target

b53836deb42539f9cf9210225054147163da19a25885f4cff5b315c76029eb2c.exe
Size

24KB
MD5

647c0f2a82206aff1b42d97f4a30996e
SHA1

b898b742171da9dc176ea3adf2cab9cea91bfcf0
SHA256

b53836deb42539f9cf9210225054147163da19a25885f4cff5b315c76029eb2c
SHA512

39bc01d7499a752b488f85db517f46ba7cbaff6117ec2b58b61e47d4aa1a4c293d4290cace857d3fa014fa32df384d909c49c8961a1f8ce85f722fb4bfc0b159
SSDEEP

384:Moy/W0F9cDf2sH+Mn+mhoBk4UD4PDlXDlGU2kCZpsA2s91UaKJ49oQEWCNJbW:4/9FSDKMhnMrZ8pOsvUXcWJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1112	1128	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 1112	1128	b53836deb42539f9cf9210225054147163da19a25885f4cff5b315c76029eb2c.exe	18
PID 1128 wrote to memory of 1112	1128	b53836deb42539f9cf9210225054147163da19a25885f4cff5b315c76029eb2c.exe	18
PID 1128 wrote to memory of 1112	1128	b53836deb42539f9cf9210225054147163da19a25885f4cff5b315c76029eb2c.exe	18
PID 1128 wrote to memory of 1112	1128	b53836deb42539f9cf9210225054147163da19a25885f4cff5b315c76029eb2c.exe	18

C:\Users\Admin\AppData\Local\Temp\b53836deb42539f9cf9210225054147163da19a25885f4cff5b315c76029eb2c.exe
"C:\Users\Admin\AppData\Local\Temp\b53836deb42539f9cf9210225054147163da19a25885f4cff5b315c76029eb2c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 196
  2⤵
  - Program crash
  PID:1112

memory/1112-55-0x0000000000000000-mapping.dmp

Download
memory/1128-54-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download
memory/1128-56-0x0000000000400000-0x0000000000454408-memory.dmp

Filesize
337KB

Download