66a11cabd54c4dcfb55fd0550ce146341d1d5d6c3ab9490e7dbd1e58369df652

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/02/2023, 13:42

Target

3928f65af9d23fc0e372676d7c9b1582c7fc55d6.exe
Size

28KB
MD5

2f402b2a3c05529a0bf93b751288ff7c
SHA1

3928f65af9d23fc0e372676d7c9b1582c7fc55d6
SHA256

66a11cabd54c4dcfb55fd0550ce146341d1d5d6c3ab9490e7dbd1e58369df652
SHA512

45af4238572403a8312639b12c79890825f157092d0bfc5a9757888fcd51accdba2bf5d5cc0125f6f00cf07c570a416b437318f650706f13b2796a012ce48cbd
SSDEEP

384:qgaY+WMQ0QPNBwrbG1ouejeDLpfsxoCWPeTKEHtnYBfvhP9cwS0TFJM996ZfaWUx:VaYD/0QPwnGet0SrWWTK7U0XE8fF

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1272	1260	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 1272	1260	3928f65af9d23fc0e372676d7c9b1582c7fc55d6.exe	28
PID 1260 wrote to memory of 1272	1260	3928f65af9d23fc0e372676d7c9b1582c7fc55d6.exe	28
PID 1260 wrote to memory of 1272	1260	3928f65af9d23fc0e372676d7c9b1582c7fc55d6.exe	28
PID 1260 wrote to memory of 1272	1260	3928f65af9d23fc0e372676d7c9b1582c7fc55d6.exe	28

C:\Users\Admin\AppData\Local\Temp\3928f65af9d23fc0e372676d7c9b1582c7fc55d6.exe
"C:\Users\Admin\AppData\Local\Temp\3928f65af9d23fc0e372676d7c9b1582c7fc55d6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 88
  2⤵
  - Program crash
  PID:1272

memory/1260-55-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download