f40a0af1c83721dee0e4234d958dc200b74df473cc06f347b99fba3b308863ce

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 05:53

Target

f40a0af1c83721dee0e4234d958dc200b74df473cc06f347b99fba3b308863ce.exe
Size

394KB
MD5

63c59052e98d04884eb8fb7f7d2d097c
SHA1

62eee9ecce1b7725b6574f7b5707019718a385df
SHA256

f40a0af1c83721dee0e4234d958dc200b74df473cc06f347b99fba3b308863ce
SHA512

15fe7d38b446d061a38fac9bb140d6da4f7870d96793a11c34e7d4bc861a89b88e7cdb8e2d6f388a6160d05ac2b307a508e2d0076271c5c538e586494474727b
SSDEEP

12288:XZm1aU/BKEvoqjdgSdlThfL3NgfKhSHLda22Ig:XYv/BKVOdgo9coYgZL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
548	112	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 112 wrote to memory of 548	112	f40a0af1c83721dee0e4234d958dc200b74df473cc06f347b99fba3b308863ce.exe	27
PID 112 wrote to memory of 548	112	f40a0af1c83721dee0e4234d958dc200b74df473cc06f347b99fba3b308863ce.exe	27
PID 112 wrote to memory of 548	112	f40a0af1c83721dee0e4234d958dc200b74df473cc06f347b99fba3b308863ce.exe	27
PID 112 wrote to memory of 548	112	f40a0af1c83721dee0e4234d958dc200b74df473cc06f347b99fba3b308863ce.exe	27

C:\Users\Admin\AppData\Local\Temp\f40a0af1c83721dee0e4234d958dc200b74df473cc06f347b99fba3b308863ce.exe
"C:\Users\Admin\AppData\Local\Temp\f40a0af1c83721dee0e4234d958dc200b74df473cc06f347b99fba3b308863ce.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 112 -s 192
  2⤵
  - Program crash
  PID:548

memory/112-54-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download