97b0929fc87f9aa0e3acae15101c9fd76ba9a89092d3078b3ca11659c9a7cde4

Analysis

max time kernel
9s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 17:07

Target

97b0929fc87f9aa0e3acae15101c9fd76ba9a89092d3078b3ca11659c9a7cde4.exe
Size

24KB
MD5

fea240f79297b3b82854a509d841a6db
SHA1

ac39e0d3ca8235159cd857355a85fe0e48275f84
SHA256

97b0929fc87f9aa0e3acae15101c9fd76ba9a89092d3078b3ca11659c9a7cde4
SHA512

4ec14cfbe0e53ab12179ccd8402a4cd186632f306a5a28da754e650cf603fec3b1f7da47179d95dca8f07251cda41e657d66cb0c3dbe8662554512f1f3a1023e
SSDEEP

192:1sNJktJXRMCkdqDtuM0Dw7A/afE2WTNRyakDIpy:1sNqDgLMJU/jLaIpy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1348	1640	WerFault.exe	2

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1348	1640	97b0929fc87f9aa0e3acae15101c9fd76ba9a89092d3078b3ca11659c9a7cde4.exe	27
PID 1640 wrote to memory of 1348	1640	97b0929fc87f9aa0e3acae15101c9fd76ba9a89092d3078b3ca11659c9a7cde4.exe	27
PID 1640 wrote to memory of 1348	1640	97b0929fc87f9aa0e3acae15101c9fd76ba9a89092d3078b3ca11659c9a7cde4.exe	27
PID 1640 wrote to memory of 1348	1640	97b0929fc87f9aa0e3acae15101c9fd76ba9a89092d3078b3ca11659c9a7cde4.exe	27

C:\Users\Admin\AppData\Local\Temp\97b0929fc87f9aa0e3acae15101c9fd76ba9a89092d3078b3ca11659c9a7cde4.exe
"C:\Users\Admin\AppData\Local\Temp\97b0929fc87f9aa0e3acae15101c9fd76ba9a89092d3078b3ca11659c9a7cde4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 88
  2⤵
  - Program crash
  PID:1348

memory/1640-55-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download