b52ce303cf7b3f69f8ba9f7961d77895b9d8171d16a4d41cfb9c9589f66e5bd7

Analysis

max time kernel
18s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 23:25

Target

b52ce303cf7b3f69f8ba9f7961d77895b9d8171d16a4d41cfb9c9589f66e5bd7.exe
Size

636KB
MD5

7bb2b14b341b3eab97e1eb05f7233bd6
SHA1

af65eb1887d4a9c0fa2fd6bc7be63290150f46d0
SHA256

b52ce303cf7b3f69f8ba9f7961d77895b9d8171d16a4d41cfb9c9589f66e5bd7
SHA512

6a0a152b2f6708e2935855cf215fcfd6a8e784b504727f7fd8b795de7d35c27d1f09442e5789d934cfc522eaaf2fe709e20231de34e1c604f00f1a34a3cd3c10
SSDEEP

12288:vIJC6TJpSzcp52Jtt78kd+zB3WbQRKKzD:AJv52Jtt78k8zke

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1068	1788	WerFault.exe	20

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 1068	1788	b52ce303cf7b3f69f8ba9f7961d77895b9d8171d16a4d41cfb9c9589f66e5bd7.exe	28
PID 1788 wrote to memory of 1068	1788	b52ce303cf7b3f69f8ba9f7961d77895b9d8171d16a4d41cfb9c9589f66e5bd7.exe	28
PID 1788 wrote to memory of 1068	1788	b52ce303cf7b3f69f8ba9f7961d77895b9d8171d16a4d41cfb9c9589f66e5bd7.exe	28
PID 1788 wrote to memory of 1068	1788	b52ce303cf7b3f69f8ba9f7961d77895b9d8171d16a4d41cfb9c9589f66e5bd7.exe	28

C:\Users\Admin\AppData\Local\Temp\b52ce303cf7b3f69f8ba9f7961d77895b9d8171d16a4d41cfb9c9589f66e5bd7.exe
"C:\Users\Admin\AppData\Local\Temp\b52ce303cf7b3f69f8ba9f7961d77895b9d8171d16a4d41cfb9c9589f66e5bd7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 204
  2⤵
  - Program crash
  PID:1068

memory/1788-54-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/1788-55-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/1788-57-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download