92ad60819a3e3959518cd90ea4a017462e0ee323247f4844db489e90b498301e

Analysis

max time kernel
37s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 12:22

Target

92ad60819a3e3959518cd90ea4a017462e0ee323247f4844db489e90b498301e.exe
Size

264KB
MD5

0060571d1b66d33378ec58d490cc133f
SHA1

73c88a4a6d975f2f266c6d46ed9ac791a32b9fc0
SHA256

92ad60819a3e3959518cd90ea4a017462e0ee323247f4844db489e90b498301e
SHA512

d7d2d378bc62142db427f63fad7ad9a8b4cef63053a98ff024075a065495561a3fc65c474c72a29f521bf6902cab97721699a563cfd53bf4185a5d0c698895a8
SSDEEP

6144:lMdWiziifCIYVbExIJjeExPKse37NpP+/lrWSYMQ:lM/zitIxxNv+/hWS2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
860	1112	WerFault.exe	20

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 860	1112	92ad60819a3e3959518cd90ea4a017462e0ee323247f4844db489e90b498301e.exe	26
PID 1112 wrote to memory of 860	1112	92ad60819a3e3959518cd90ea4a017462e0ee323247f4844db489e90b498301e.exe	26
PID 1112 wrote to memory of 860	1112	92ad60819a3e3959518cd90ea4a017462e0ee323247f4844db489e90b498301e.exe	26
PID 1112 wrote to memory of 860	1112	92ad60819a3e3959518cd90ea4a017462e0ee323247f4844db489e90b498301e.exe	26

C:\Users\Admin\AppData\Local\Temp\92ad60819a3e3959518cd90ea4a017462e0ee323247f4844db489e90b498301e.exe
"C:\Users\Admin\AppData\Local\Temp\92ad60819a3e3959518cd90ea4a017462e0ee323247f4844db489e90b498301e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 180
  2⤵
  - Program crash
  PID:860

memory/1112-54-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download
memory/1112-55-0x0000000000220000-0x0000000000226000-memory.dmp

Filesize
24KB

Download
memory/1112-56-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download