ba096b7fbc460c9d4c85b60f3c861cbbb715adf40d1f790715e2bfa92f4eec23

Analysis

max time kernel
35s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/02/2023, 13:40

Target

547544ccfbad66ad7b09fc19b3b4beccd91bce25.exe
Size

24KB
MD5

1a636c62fdc40df801494b27d613f42e
SHA1

547544ccfbad66ad7b09fc19b3b4beccd91bce25
SHA256

ba096b7fbc460c9d4c85b60f3c861cbbb715adf40d1f790715e2bfa92f4eec23
SHA512

76f569588e83108ced1344df9ba1dc5f1a09c6e5f895b0597d81b6056f6b5a2593470abc61992d9e9387193b26963517b566b37f745019e2130803c2c3072f16
SSDEEP

192:EOg/UkEhD0bW7lb9vJknX/FmLTOE3NxCng93azOYs87KF9:EO6UkEabW7lpvWX/FrE3N8nE3aiq7K

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1368	1940	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 1368	1940	547544ccfbad66ad7b09fc19b3b4beccd91bce25.exe	26
PID 1940 wrote to memory of 1368	1940	547544ccfbad66ad7b09fc19b3b4beccd91bce25.exe	26
PID 1940 wrote to memory of 1368	1940	547544ccfbad66ad7b09fc19b3b4beccd91bce25.exe	26
PID 1940 wrote to memory of 1368	1940	547544ccfbad66ad7b09fc19b3b4beccd91bce25.exe	26

C:\Users\Admin\AppData\Local\Temp\547544ccfbad66ad7b09fc19b3b4beccd91bce25.exe
"C:\Users\Admin\AppData\Local\Temp\547544ccfbad66ad7b09fc19b3b4beccd91bce25.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 88
  2⤵
  - Program crash
  PID:1368

memory/1940-55-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download