7072edbd67361fd77c585e15bb8d39dc9fdf7112da820ae9dc3cf2b7b565c961

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02-02-2023 05:13

Target

7072edbd67361fd77c585e15bb8d39dc9fdf7112da820ae9dc3cf2b7b565c961.exe
Size

88KB
MD5

51bd499b66a84a21a7e076fe35bf0376
SHA1

d8739508b3495081effcf07fd2225c031d782390
SHA256

7072edbd67361fd77c585e15bb8d39dc9fdf7112da820ae9dc3cf2b7b565c961
SHA512

2593860947541614833167b8a3d2fcdb9cb60eff1f4cc7f46ff670f70e58f62621c437119e9c8dcfc9d28c3a8731eaf4338a2b1144b4bdd30871b878ea81e6f5
SSDEEP

1536:NcRIdAcyMGAbEOc5I6/tH96kXZSoAOE9oMM:SA6/tH96kq9LM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1460	1320	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 1460	1320	7072edbd67361fd77c585e15bb8d39dc9fdf7112da820ae9dc3cf2b7b565c961.exe	28
PID 1320 wrote to memory of 1460	1320	7072edbd67361fd77c585e15bb8d39dc9fdf7112da820ae9dc3cf2b7b565c961.exe	28
PID 1320 wrote to memory of 1460	1320	7072edbd67361fd77c585e15bb8d39dc9fdf7112da820ae9dc3cf2b7b565c961.exe	28
PID 1320 wrote to memory of 1460	1320	7072edbd67361fd77c585e15bb8d39dc9fdf7112da820ae9dc3cf2b7b565c961.exe	28

C:\Users\Admin\AppData\Local\Temp\7072edbd67361fd77c585e15bb8d39dc9fdf7112da820ae9dc3cf2b7b565c961.exe
"C:\Users\Admin\AppData\Local\Temp\7072edbd67361fd77c585e15bb8d39dc9fdf7112da820ae9dc3cf2b7b565c961.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1320 -s 96
  2⤵
  - Program crash
  PID:1460