f0ead3b31a60148b00cf51cfb8faf26060e3abc4e19ba0f56cfc841401d573be

Analysis

max time kernel
31s
max time network
84s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 15:22

Target

f0ead3b31a60148b00cf51cfb8faf26060e3abc4e19ba0f56cfc841401d573be.exe
Size

482KB
MD5

65e1a424a4ad779a4e68784de4b643d9
SHA1

5ac688ecac745226c92f0a5ba6e6a2212cd6d396
SHA256

f0ead3b31a60148b00cf51cfb8faf26060e3abc4e19ba0f56cfc841401d573be
SHA512

9baba4b4268fba13691057164d693ab04ab663f743ba5710a2c7dabcc6b03d50801b20c75efd1d35bc30bac52874f495a7618e001c65848c36c7f41993289b37
SSDEEP

6144:7aj23fguhe2XJHZmGE+oHnemCiTuLq7CYTAbRvKNgHsoY723ta8IUauQ1V/88KB7:7aGhpmmiTwbRvRsea8lcN+2+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
592	2040	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 592	2040	f0ead3b31a60148b00cf51cfb8faf26060e3abc4e19ba0f56cfc841401d573be.exe	28
PID 2040 wrote to memory of 592	2040	f0ead3b31a60148b00cf51cfb8faf26060e3abc4e19ba0f56cfc841401d573be.exe	28
PID 2040 wrote to memory of 592	2040	f0ead3b31a60148b00cf51cfb8faf26060e3abc4e19ba0f56cfc841401d573be.exe	28
PID 2040 wrote to memory of 592	2040	f0ead3b31a60148b00cf51cfb8faf26060e3abc4e19ba0f56cfc841401d573be.exe	28

C:\Users\Admin\AppData\Local\Temp\f0ead3b31a60148b00cf51cfb8faf26060e3abc4e19ba0f56cfc841401d573be.exe
"C:\Users\Admin\AppData\Local\Temp\f0ead3b31a60148b00cf51cfb8faf26060e3abc4e19ba0f56cfc841401d573be.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 604
  2⤵
  - Program crash
  PID:592

memory/2040-54-0x0000000075891000-0x0000000075893000-memory.dmp

Filesize
8KB

Download