f7961f6322e41cbe9db978aabe1167da4ee3d36a8b76bf266bc5b6d51886717f

Analysis

max time kernel
7s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/12/2022, 02:25

Target

f7961f6322e41cbe9db978aabe1167da4ee3d36a8b76bf266bc5b6d51886717f.exe
Size

1.0MB
MD5

5d54c87c7af1d560799b622a11985015
SHA1

6b316a4f6766ac20a6cc94c05c2107b5f30c6dac
SHA256

f7961f6322e41cbe9db978aabe1167da4ee3d36a8b76bf266bc5b6d51886717f
SHA512

0f9d7243c26c8eb10f52225620c3ef579f4fd3fadd9f8828eb2f53622d9d64a50f508abfa26957a9023ed23e1846ed78bae2b23383bc9696847d560c72badb19
SSDEEP

6144:+qqC00nl+GEvD4MrfgY2qqC00L5mYmdjdmuX0o/hZn0PqCu/ipd5OehJ6MH:+qck4bTwqchYKWOhZnwGaD5nhH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1728	1536	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 1728	1536	f7961f6322e41cbe9db978aabe1167da4ee3d36a8b76bf266bc5b6d51886717f.exe	27
PID 1536 wrote to memory of 1728	1536	f7961f6322e41cbe9db978aabe1167da4ee3d36a8b76bf266bc5b6d51886717f.exe	27
PID 1536 wrote to memory of 1728	1536	f7961f6322e41cbe9db978aabe1167da4ee3d36a8b76bf266bc5b6d51886717f.exe	27
PID 1536 wrote to memory of 1728	1536	f7961f6322e41cbe9db978aabe1167da4ee3d36a8b76bf266bc5b6d51886717f.exe	27

C:\Users\Admin\AppData\Local\Temp\f7961f6322e41cbe9db978aabe1167da4ee3d36a8b76bf266bc5b6d51886717f.exe
"C:\Users\Admin\AppData\Local\Temp\f7961f6322e41cbe9db978aabe1167da4ee3d36a8b76bf266bc5b6d51886717f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 148
  2⤵
  - Program crash
  PID:1728

memory/1536-55-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download