c807bf84b883bf60c50163a625a16fe25554de9f9e60cf8888552417be413dc2

Analysis

max time kernel
41s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 06:10

Target

c807bf84b883bf60c50163a625a16fe25554de9f9e60cf8888552417be413dc2.exe
Size

259KB
MD5

c0867486c67f9e2318b2b66496107d1a
SHA1

eed6ee3ebb02f771c43d29a1a09427be8794bc15
SHA256

c807bf84b883bf60c50163a625a16fe25554de9f9e60cf8888552417be413dc2
SHA512

5b877134b745a9a74bc516d4159ceafa350af24fab714d43eb3cadfc5f8e9ad283b3c86e1ceb29b679c338fc709dfb6f1b3976b9bf8d45557e9f40606d756900
SSDEEP

3072:InnAQVG/LytaKItS/fiLKS+f5Aq7iIr27IsSJs/pVJzIxFY4PRUh2/YY3cn/QvS1:EOTeHI8HiL7+f5T4IlYxwFr5tE/T/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1104	2032	WerFault.exe	19

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1104	2032	c807bf84b883bf60c50163a625a16fe25554de9f9e60cf8888552417be413dc2.exe	26
PID 2032 wrote to memory of 1104	2032	c807bf84b883bf60c50163a625a16fe25554de9f9e60cf8888552417be413dc2.exe	26
PID 2032 wrote to memory of 1104	2032	c807bf84b883bf60c50163a625a16fe25554de9f9e60cf8888552417be413dc2.exe	26
PID 2032 wrote to memory of 1104	2032	c807bf84b883bf60c50163a625a16fe25554de9f9e60cf8888552417be413dc2.exe	26

C:\Users\Admin\AppData\Local\Temp\c807bf84b883bf60c50163a625a16fe25554de9f9e60cf8888552417be413dc2.exe
"C:\Users\Admin\AppData\Local\Temp\c807bf84b883bf60c50163a625a16fe25554de9f9e60cf8888552417be413dc2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 172
  2⤵
  - Program crash
  PID:1104

memory/2032-54-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download
memory/2032-56-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download