f79126d0b531459a50efe466a9cd55ff1f3b8ead5619953ba3d5fafcca26c2fc

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 05:46

Target

f79126d0b531459a50efe466a9cd55ff1f3b8ead5619953ba3d5fafcca26c2fc.exe
Size

55KB
MD5

4a837c33f696fe22efc0de22c73f81d8
SHA1

00912293c99cd4ff6d87895f2b7d7cebeb289424
SHA256

f79126d0b531459a50efe466a9cd55ff1f3b8ead5619953ba3d5fafcca26c2fc
SHA512

6f6376827202a1634108c9f32a7f39710743d3ac262c37a29ee5aaa1f28ca506e9cbcb81f227759fabb8e516674a44f292bee3c81e132cdf9e55acac92b44f4d
SSDEEP

1536:CWhvQQfZ4cFI4yunxcZ0xFbLe+ctEGb2xAUN:XhvQO4B4DnO0/fSiP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1712	1636	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1712	1636	f79126d0b531459a50efe466a9cd55ff1f3b8ead5619953ba3d5fafcca26c2fc.exe	27
PID 1636 wrote to memory of 1712	1636	f79126d0b531459a50efe466a9cd55ff1f3b8ead5619953ba3d5fafcca26c2fc.exe	27
PID 1636 wrote to memory of 1712	1636	f79126d0b531459a50efe466a9cd55ff1f3b8ead5619953ba3d5fafcca26c2fc.exe	27
PID 1636 wrote to memory of 1712	1636	f79126d0b531459a50efe466a9cd55ff1f3b8ead5619953ba3d5fafcca26c2fc.exe	27

C:\Users\Admin\AppData\Local\Temp\f79126d0b531459a50efe466a9cd55ff1f3b8ead5619953ba3d5fafcca26c2fc.exe
"C:\Users\Admin\AppData\Local\Temp\f79126d0b531459a50efe466a9cd55ff1f3b8ead5619953ba3d5fafcca26c2fc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 36
  2⤵
  - Program crash
  PID:1712

memory/1636-55-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download