789bfd0dcaad2d1570bb859c759de1fb8a2af8707b37037b357f8b5b6fbece81

Analysis

max time kernel
43s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07/12/2022, 02:57

Target

789bfd0dcaad2d1570bb859c759de1fb8a2af8707b37037b357f8b5b6fbece81.exe
Size

224KB
MD5

30e7bf4a167dedea019ffaddd2ee5930
SHA1

6a9299f1fcb3552214457e0ca7ebad4f782915d1
SHA256

789bfd0dcaad2d1570bb859c759de1fb8a2af8707b37037b357f8b5b6fbece81
SHA512

172635bb6b7f09fcf36cf265851cb98e7389c2ff137d9b734a3f823fc57e2ecaeb8ff7fc211226fc0d2b0b0d4bda48d6b2b85a906434cec165594b5ed36aebc5
SSDEEP

1536:y1pMooIDVxo+mJz0sr9QUpHgsbRBGS1+l5/rlAOXBOhwLAKtoJi+A70fYoyv8+0V:y7MLuJmXrOUJgsbT+OukKtd2yv8+8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1188	1732	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1188	1732	789bfd0dcaad2d1570bb859c759de1fb8a2af8707b37037b357f8b5b6fbece81.exe	27
PID 1732 wrote to memory of 1188	1732	789bfd0dcaad2d1570bb859c759de1fb8a2af8707b37037b357f8b5b6fbece81.exe	27
PID 1732 wrote to memory of 1188	1732	789bfd0dcaad2d1570bb859c759de1fb8a2af8707b37037b357f8b5b6fbece81.exe	27
PID 1732 wrote to memory of 1188	1732	789bfd0dcaad2d1570bb859c759de1fb8a2af8707b37037b357f8b5b6fbece81.exe	27

C:\Users\Admin\AppData\Local\Temp\789bfd0dcaad2d1570bb859c759de1fb8a2af8707b37037b357f8b5b6fbece81.exe
"C:\Users\Admin\AppData\Local\Temp\789bfd0dcaad2d1570bb859c759de1fb8a2af8707b37037b357f8b5b6fbece81.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 148
  2⤵
  - Program crash
  PID:1188

memory/1732-55-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download