3f18f52b02f045e47197cb7b946200894756dae1c0f1510884ec9b0cb8e046b2

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24-03-2023 11:01

Target

3f18f52b02f045e47197cb7b946200894756dae1c0f1510884ec9b0cb8e046b2.exe
Size

1.6MB
MD5

88029ba38cd4fd47abf1642b6ce244bc
SHA1

1934404514726923ff034c8cb19e87a49c8e346b
SHA256

3f18f52b02f045e47197cb7b946200894756dae1c0f1510884ec9b0cb8e046b2
SHA512

c516ec55c490b833cfa7f1c6ccb823008d2118376ff0e7d4752a6eac8c6ad2b432b872c213c34175551647c160a73f24c351992ca3c0a3eba1703907d7ba6554
SSDEEP

24576:lxkW1Amub4RP5EM5yVaX1PXocKKfWk8m99PGBQbgiHMYrTv6zKiwE:lx9VEM5SRcKKuvkgBQkyTv6DwE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1692	1656	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1692	1656	3f18f52b02f045e47197cb7b946200894756dae1c0f1510884ec9b0cb8e046b2.exe	28
PID 1656 wrote to memory of 1692	1656	3f18f52b02f045e47197cb7b946200894756dae1c0f1510884ec9b0cb8e046b2.exe	28
PID 1656 wrote to memory of 1692	1656	3f18f52b02f045e47197cb7b946200894756dae1c0f1510884ec9b0cb8e046b2.exe	28
PID 1656 wrote to memory of 1692	1656	3f18f52b02f045e47197cb7b946200894756dae1c0f1510884ec9b0cb8e046b2.exe	28

C:\Users\Admin\AppData\Local\Temp\3f18f52b02f045e47197cb7b946200894756dae1c0f1510884ec9b0cb8e046b2.exe
"C:\Users\Admin\AppData\Local\Temp\3f18f52b02f045e47197cb7b946200894756dae1c0f1510884ec9b0cb8e046b2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 252
  2⤵
  - Program crash
  PID:1692

memory/1656-54-0x0000000000AD0000-0x0000000000C93000-memory.dmp

Filesize
1.8MB

Download