f3abc4bba53c2986900098640cfd900e8bded0f84aedc28bd097003b4924988a

Analysis

max time kernel
28s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 11:34

Target

f3abc4bba53c2986900098640cfd900e8bded0f84aedc28bd097003b4924988a.exe
Size

522KB
MD5

ffc8b364e229174187a7e5c24d08427b
SHA1

2f748385f05c58021aa70c6a3cce625653d39887
SHA256

f3abc4bba53c2986900098640cfd900e8bded0f84aedc28bd097003b4924988a
SHA512

dfb298e53449d2d45c2b8a2f12c509ab9d65f6f18910c492e0509b8a6013272444db4b60474ce5b48c5c73cf35408369d5e7e7cf3fb4faf3ac75776ccf01f42c
SSDEEP

12288:ReeA44GiqeKf10JtQBEtTMR8PgNodBI9WIY8sDHNtTirddH1D68wE:R5A4Ppf1ctQBENMR8PD7rTEdd1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1320	1216	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 1320	1216	f3abc4bba53c2986900098640cfd900e8bded0f84aedc28bd097003b4924988a.exe	28
PID 1216 wrote to memory of 1320	1216	f3abc4bba53c2986900098640cfd900e8bded0f84aedc28bd097003b4924988a.exe	28
PID 1216 wrote to memory of 1320	1216	f3abc4bba53c2986900098640cfd900e8bded0f84aedc28bd097003b4924988a.exe	28
PID 1216 wrote to memory of 1320	1216	f3abc4bba53c2986900098640cfd900e8bded0f84aedc28bd097003b4924988a.exe	28

C:\Users\Admin\AppData\Local\Temp\f3abc4bba53c2986900098640cfd900e8bded0f84aedc28bd097003b4924988a.exe
"C:\Users\Admin\AppData\Local\Temp\f3abc4bba53c2986900098640cfd900e8bded0f84aedc28bd097003b4924988a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 36
  2⤵
  - Program crash
  PID:1320

memory/1216-55-0x0000000000400000-0x00000000004FB000-memory.dmp

Filesize
1004KB

Download