55bf2bde437f914c826ccdba3137233d28f135b18f7b8fad855bfb5095fa630b

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 13:07

Target

55bf2bde437f914c826ccdba3137233d28f135b18f7b8fad855bfb5095fa630b.exe
Size

414KB
MD5

595d42642142a10565fa36197b415ee6
SHA1

6bc784974e32c23d5b6a92f7e2585ca967175ecc
SHA256

55bf2bde437f914c826ccdba3137233d28f135b18f7b8fad855bfb5095fa630b
SHA512

f7c55a45802a55647bf97ede873866fca12ed8aa302a34ae07aa64d1589795fc1c2219fa7285799028c1f3ea5baa27d84119f6faf3f7d61ea5d12c50416c7ca8
SSDEEP

3072:lmBfrS7baAhki96wTMEzJjHCXz33333333N33333333OqGMwqn5dFNijROw66ZwF:lmBK7ABUHCXIe/FgOwpwqqi+ZP2JEj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1260	832	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 1260	832	55bf2bde437f914c826ccdba3137233d28f135b18f7b8fad855bfb5095fa630b.exe	28
PID 832 wrote to memory of 1260	832	55bf2bde437f914c826ccdba3137233d28f135b18f7b8fad855bfb5095fa630b.exe	28
PID 832 wrote to memory of 1260	832	55bf2bde437f914c826ccdba3137233d28f135b18f7b8fad855bfb5095fa630b.exe	28
PID 832 wrote to memory of 1260	832	55bf2bde437f914c826ccdba3137233d28f135b18f7b8fad855bfb5095fa630b.exe	28

C:\Users\Admin\AppData\Local\Temp\55bf2bde437f914c826ccdba3137233d28f135b18f7b8fad855bfb5095fa630b.exe
"C:\Users\Admin\AppData\Local\Temp\55bf2bde437f914c826ccdba3137233d28f135b18f7b8fad855bfb5095fa630b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 832 -s 120
  2⤵
  - Program crash
  PID:1260

memory/832-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/832-56-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download