23815efb85d1487d48a3ec01c6422b702808452e62959c84333e4139065a7bd6

Analysis

max time kernel
3s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 11:56

Target

23815efb85d1487d48a3ec01c6422b702808452e62959c84333e4139065a7bd6.exe
Size

106KB
MD5

e613c02857830189e17b884ffe44f4f3
SHA1

a7cbbfdf9c73ea0d005c429fee5a766c6194981c
SHA256

23815efb85d1487d48a3ec01c6422b702808452e62959c84333e4139065a7bd6
SHA512

9b3419336ca47c7a29290d7388e2c13d2c3557b6ab69ef55052600499906a3bde0947253e80ebc88e878c740a24bcaa684ef56d2833a2c779207c977b744a5c0
SSDEEP

1536:af+FDoKXniY1u7Nn2JFkC2styJjCKICFjC7EWisS+5mlatSfkZi:af+FDRK71QkbstyJjCKICpC72s/mlaXi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
832	1772	WerFault.exe	23

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 832	1772	23815efb85d1487d48a3ec01c6422b702808452e62959c84333e4139065a7bd6.exe	28
PID 1772 wrote to memory of 832	1772	23815efb85d1487d48a3ec01c6422b702808452e62959c84333e4139065a7bd6.exe	28
PID 1772 wrote to memory of 832	1772	23815efb85d1487d48a3ec01c6422b702808452e62959c84333e4139065a7bd6.exe	28
PID 1772 wrote to memory of 832	1772	23815efb85d1487d48a3ec01c6422b702808452e62959c84333e4139065a7bd6.exe	28

C:\Users\Admin\AppData\Local\Temp\23815efb85d1487d48a3ec01c6422b702808452e62959c84333e4139065a7bd6.exe
"C:\Users\Admin\AppData\Local\Temp\23815efb85d1487d48a3ec01c6422b702808452e62959c84333e4139065a7bd6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 124
  2⤵
  - Program crash
  PID:832

memory/1772-55-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download