94ff654c4d7f294b922cf88a3ddac0207f9639ecb2dccb37b5bd6047395a0578

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 12:05

Target

94ff654c4d7f294b922cf88a3ddac0207f9639ecb2dccb37b5bd6047395a0578.exe
Size

286KB
MD5

d007281dad238caf0653e1e2c8633ee7
SHA1

281c2b0d126113ae216f30b286935bdb0f1c070a
SHA256

94ff654c4d7f294b922cf88a3ddac0207f9639ecb2dccb37b5bd6047395a0578
SHA512

066bf5294941ac63fd15e3e68a7a3df7d6dad0dbc87f53ec5acb99874e09ed1347ed494fc320f899ca90c5fd1b21e2bd9dc238c44fb2c0588d4b97a04b7f46c9
SSDEEP

6144:hF00O4BYwPDgePEGIe6Je6i8fjgzJ1Mb1OD+Ok:/XrDZTI3Je6ipzJ+xOD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1576	1672	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1576	1672	94ff654c4d7f294b922cf88a3ddac0207f9639ecb2dccb37b5bd6047395a0578.exe	27
PID 1672 wrote to memory of 1576	1672	94ff654c4d7f294b922cf88a3ddac0207f9639ecb2dccb37b5bd6047395a0578.exe	27
PID 1672 wrote to memory of 1576	1672	94ff654c4d7f294b922cf88a3ddac0207f9639ecb2dccb37b5bd6047395a0578.exe	27
PID 1672 wrote to memory of 1576	1672	94ff654c4d7f294b922cf88a3ddac0207f9639ecb2dccb37b5bd6047395a0578.exe	27

C:\Users\Admin\AppData\Local\Temp\94ff654c4d7f294b922cf88a3ddac0207f9639ecb2dccb37b5bd6047395a0578.exe
"C:\Users\Admin\AppData\Local\Temp\94ff654c4d7f294b922cf88a3ddac0207f9639ecb2dccb37b5bd6047395a0578.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 148
  2⤵
  - Program crash
  PID:1576

memory/1672-54-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download