1fa649d9365b3c2ff45f35af1bbf8ebdbdcc455928827475252e8417a07f2519

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
12-08-2023 06:50

Target

1fa649d9365b3c2ff45f35af1bbf8ebdbdcc455928827475252e8417a07f2519.exe
Size

67KB
MD5

d282040c9d730bd938b59221127cda01
SHA1

c7b33599f867961b3ebff699751cb31f84a2ebc7
SHA256

1fa649d9365b3c2ff45f35af1bbf8ebdbdcc455928827475252e8417a07f2519
SHA512

a777394653ecf04d632ecf13a4b9581878c3d8fa953f4e4928846ae79bfa08399c50416a4b9dc9e7d30e98449cebd07d0e4b647c5172e96fe555289d8b663ea0
SSDEEP

1536:Lpmh8mcUyppcli5GXZCNeFzW+loL+v9k11zFT4v:LO5cUyppoiEgEFlOL++PzFC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1820	1532	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 1820	1532	1fa649d9365b3c2ff45f35af1bbf8ebdbdcc455928827475252e8417a07f2519.exe	28
PID 1532 wrote to memory of 1820	1532	1fa649d9365b3c2ff45f35af1bbf8ebdbdcc455928827475252e8417a07f2519.exe	28
PID 1532 wrote to memory of 1820	1532	1fa649d9365b3c2ff45f35af1bbf8ebdbdcc455928827475252e8417a07f2519.exe	28
PID 1532 wrote to memory of 1820	1532	1fa649d9365b3c2ff45f35af1bbf8ebdbdcc455928827475252e8417a07f2519.exe	28

C:\Users\Admin\AppData\Local\Temp\1fa649d9365b3c2ff45f35af1bbf8ebdbdcc455928827475252e8417a07f2519.exe
"C:\Users\Admin\AppData\Local\Temp\1fa649d9365b3c2ff45f35af1bbf8ebdbdcc455928827475252e8417a07f2519.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 116
  2⤵
  - Program crash
  PID:1820

memory/1532-56-0x00000000008B0000-0x00000000008CD000-memory.dmp

Filesize
116KB

Download
memory/1532-55-0x00000000008B0000-0x00000000008CD000-memory.dmp

Filesize
116KB

Download
memory/1532-54-0x00000000008B0000-0x00000000008CD000-memory.dmp

Filesize
116KB

Download
memory/1532-57-0x0000000002510000-0x0000000002550000-memory.dmp

Filesize
256KB

Download
memory/1532-58-0x00000000008B0000-0x00000000008CD000-memory.dmp

Filesize
116KB

Download