ed4621af7f8c7f0eea9bee54d5acf0d108c752232254d45227da1313ddf27141

Analysis

max time kernel
25s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
07/12/2022, 03:44

Target

ed4621af7f8c7f0eea9bee54d5acf0d108c752232254d45227da1313ddf27141.exe
Size

916KB
MD5

053017dad195dce2bcae4ac2e941a8d0
SHA1

4e639a992753fa2b7925e5ccff4528f63e9df3ae
SHA256

ed4621af7f8c7f0eea9bee54d5acf0d108c752232254d45227da1313ddf27141
SHA512

86f5307429bd193e1cfe194e8844a3c553e9b18208236b55f04a336ededc39d1ad1a91494dd0c1639d972923ae3e9cee8157ab70ff5b203ce1e205220fa8e9de
SSDEEP

12288:fZOU58SlsSliSlb6XVDU1I+4+5+by/y/yS5sy/yS5syS5Z5Z5sy/yS5syS5syS5L:fZOxSlsSliSlyglaa2a2ea22S2s

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
944	956	WerFault.exe	11

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 944	956	ed4621af7f8c7f0eea9bee54d5acf0d108c752232254d45227da1313ddf27141.exe	28
PID 956 wrote to memory of 944	956	ed4621af7f8c7f0eea9bee54d5acf0d108c752232254d45227da1313ddf27141.exe	28
PID 956 wrote to memory of 944	956	ed4621af7f8c7f0eea9bee54d5acf0d108c752232254d45227da1313ddf27141.exe	28
PID 956 wrote to memory of 944	956	ed4621af7f8c7f0eea9bee54d5acf0d108c752232254d45227da1313ddf27141.exe	28

C:\Users\Admin\AppData\Local\Temp\ed4621af7f8c7f0eea9bee54d5acf0d108c752232254d45227da1313ddf27141.exe
"C:\Users\Admin\AppData\Local\Temp\ed4621af7f8c7f0eea9bee54d5acf0d108c752232254d45227da1313ddf27141.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 956 -s 88
  2⤵
  - Program crash
  PID:944

memory/956-55-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download