f2256858e7d9d1df94ee50c253c96d155fa0443a4d713101abface18a089c948

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 09:07

Target

f2256858e7d9d1df94ee50c253c96d155fa0443a4d713101abface18a089c948.exe
Size

74KB
MD5

9f2ef658103234e9f5689fb61ef3fc7a
SHA1

78e27f0de170b0b829687b4a9fcb7295f011c078
SHA256

f2256858e7d9d1df94ee50c253c96d155fa0443a4d713101abface18a089c948
SHA512

2082e40ba9ef31f6803acaf0f5e927027f97b7b9a3ca16a1f5e1cb5c9bffc66246c166fc2d18437da4cd6ed03dde124c26819e679198d28460ad2e3ff2bc2422
SSDEEP

768:/Zx9fvq5n0p/tNm2XBwOS5nC6mraP4Z6gTYfsQN5hrt0l/4wsiHoCPHCI7yIYmd:/Zxtm22O62fTYU0t0l5snRJlS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
976	1916	WerFault.exe	21

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 976	1916	f2256858e7d9d1df94ee50c253c96d155fa0443a4d713101abface18a089c948.exe	27
PID 1916 wrote to memory of 976	1916	f2256858e7d9d1df94ee50c253c96d155fa0443a4d713101abface18a089c948.exe	27
PID 1916 wrote to memory of 976	1916	f2256858e7d9d1df94ee50c253c96d155fa0443a4d713101abface18a089c948.exe	27
PID 1916 wrote to memory of 976	1916	f2256858e7d9d1df94ee50c253c96d155fa0443a4d713101abface18a089c948.exe	27

C:\Users\Admin\AppData\Local\Temp\f2256858e7d9d1df94ee50c253c96d155fa0443a4d713101abface18a089c948.exe
"C:\Users\Admin\AppData\Local\Temp\f2256858e7d9d1df94ee50c253c96d155fa0443a4d713101abface18a089c948.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 148
  2⤵
  - Program crash
  PID:976

memory/1916-55-0x0000000000400000-0x000000000041290A-memory.dmp

Filesize
74KB

Download