f591f3b46cc1844550906abe587a1d82b96b37bac5621c1937ab8b0552258417

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19/07/2023, 06:43

Target

a95f9a75b4460b7983279a879c9ec0f9.exe
Size

620KB
MD5

a95f9a75b4460b7983279a879c9ec0f9
SHA1

b2d50a2baca82a5a900a0cdc83921ee33ec5f558
SHA256

f591f3b46cc1844550906abe587a1d82b96b37bac5621c1937ab8b0552258417
SHA512

6217a9a46537df1afb6f837818f4a5a49abaf08cd1310810e3683ef5bbe141b65ff83f82d2142f30f3fa95bce2dcd96e788dd82451f0d144090ed4cb7dee825f
SSDEEP

12288:0PYPfY7NWu5uZY6rmFpXUhNUSKpOILx6Peo:0PYPgwuKYtwUfO0x6Pe

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2548	2676	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2548	2676	a95f9a75b4460b7983279a879c9ec0f9.exe	30
PID 2676 wrote to memory of 2548	2676	a95f9a75b4460b7983279a879c9ec0f9.exe	30
PID 2676 wrote to memory of 2548	2676	a95f9a75b4460b7983279a879c9ec0f9.exe	30
PID 2676 wrote to memory of 2548	2676	a95f9a75b4460b7983279a879c9ec0f9.exe	30

C:\Users\Admin\AppData\Local\Temp\a95f9a75b4460b7983279a879c9ec0f9.exe
"C:\Users\Admin\AppData\Local\Temp\a95f9a75b4460b7983279a879c9ec0f9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 656
  2⤵
  - Program crash
  PID:2548

memory/2676-54-0x0000000073F70000-0x000000007465E000-memory.dmp

Filesize
6.9MB

Download
memory/2676-53-0x0000000000050000-0x00000000000F0000-memory.dmp

Filesize
640KB

Download
memory/2676-55-0x0000000005050000-0x0000000005090000-memory.dmp

Filesize
256KB

Download
memory/2676-56-0x00000000005F0000-0x00000000005FE000-memory.dmp

Filesize
56KB

Download
memory/2676-57-0x0000000073F70000-0x000000007465E000-memory.dmp

Filesize
6.9MB

Download
memory/2676-58-0x0000000005050000-0x0000000005090000-memory.dmp

Filesize
256KB

Download
memory/2676-59-0x0000000000760000-0x000000000076A000-memory.dmp

Filesize
40KB

Download