badbe59382fafd26597f886b86506c37f968516e01d20ac47accab3bc0664cbc

Analysis

max time kernel
39s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 13:43

Target

badbe59382fafd26597f886b86506c37f968516e01d20ac47accab3bc0664cbc.exe
Size

188KB
MD5

32322abd842b15da20bed57bc484b032
SHA1

c914348c9cdf2f588746e97ed685b197e6bb0444
SHA256

badbe59382fafd26597f886b86506c37f968516e01d20ac47accab3bc0664cbc
SHA512

ffccf55e2a30976bc3114936bc6e3a0c312fac5d0e19ee8b7c42ceeb0ef2f756c58b2602db37ceb12399117c478e2207c4f1b43f40a32bb66ad1efe1862e7acb
SSDEEP

1536:l/KVvhq8aP//mEGE7NqeT0GQpTLSsE9mQZjFE4ahXohF5kYlmM4Q7/hsULFfWuv:xHx/mRE0e0Ga/E9DFt2ohFrlN/2+OI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1648	1632	WerFault.exe	19

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1648	1632	badbe59382fafd26597f886b86506c37f968516e01d20ac47accab3bc0664cbc.exe	28
PID 1632 wrote to memory of 1648	1632	badbe59382fafd26597f886b86506c37f968516e01d20ac47accab3bc0664cbc.exe	28
PID 1632 wrote to memory of 1648	1632	badbe59382fafd26597f886b86506c37f968516e01d20ac47accab3bc0664cbc.exe	28
PID 1632 wrote to memory of 1648	1632	badbe59382fafd26597f886b86506c37f968516e01d20ac47accab3bc0664cbc.exe	28
PID 1632 wrote to memory of 1648	1632	badbe59382fafd26597f886b86506c37f968516e01d20ac47accab3bc0664cbc.exe	28
PID 1632 wrote to memory of 1648	1632	badbe59382fafd26597f886b86506c37f968516e01d20ac47accab3bc0664cbc.exe	28
PID 1632 wrote to memory of 1648	1632	badbe59382fafd26597f886b86506c37f968516e01d20ac47accab3bc0664cbc.exe	28

C:\Users\Admin\AppData\Local\Temp\badbe59382fafd26597f886b86506c37f968516e01d20ac47accab3bc0664cbc.exe
"C:\Users\Admin\AppData\Local\Temp\badbe59382fafd26597f886b86506c37f968516e01d20ac47accab3bc0664cbc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 364
  2⤵
  - Program crash
  PID:1648

memory/1632-54-0x00000000757B1000-0x00000000757B3000-memory.dmp

Filesize
8KB

Download
memory/1648-55-0x0000000000000000-mapping.dmp

Download