822fdb61ba0bf0f8d90ca5ae981cc4a903c98b541aff91bb50bc5a53ecb5e6dd

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 01:19

Target

822fdb61ba0bf0f8d90ca5ae981cc4a903c98b541aff91bb50bc5a53ecb5e6dd.exe
Size

396KB
MD5

b45cd3c2fdf57fa8a6f132919b02ac94
SHA1

60f4119079730a3f41250aebde74139b0524754b
SHA256

822fdb61ba0bf0f8d90ca5ae981cc4a903c98b541aff91bb50bc5a53ecb5e6dd
SHA512

6c150f967ef85820b5057cbe48daf5f8951efaeef602e0e6b400f07bb832c9c0c0a00e882ab09d81af437a6f57365ffd578d17255e0a254e3cac683345186d57
SSDEEP

6144:z6ppv/syQTfamA1AxyoXG7tKsKWctiWHYf4W6sEuP1CbRbMWtQb+NN1eRPI:z6UyQTfaTulbiW4QPTsiJMWtQb+7gI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2188	2192	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2188	2192	822fdb61ba0bf0f8d90ca5ae981cc4a903c98b541aff91bb50bc5a53ecb5e6dd.exe	29
PID 2192 wrote to memory of 2188	2192	822fdb61ba0bf0f8d90ca5ae981cc4a903c98b541aff91bb50bc5a53ecb5e6dd.exe	29
PID 2192 wrote to memory of 2188	2192	822fdb61ba0bf0f8d90ca5ae981cc4a903c98b541aff91bb50bc5a53ecb5e6dd.exe	29
PID 2192 wrote to memory of 2188	2192	822fdb61ba0bf0f8d90ca5ae981cc4a903c98b541aff91bb50bc5a53ecb5e6dd.exe	29

C:\Users\Admin\AppData\Local\Temp\822fdb61ba0bf0f8d90ca5ae981cc4a903c98b541aff91bb50bc5a53ecb5e6dd.exe
"C:\Users\Admin\AppData\Local\Temp\822fdb61ba0bf0f8d90ca5ae981cc4a903c98b541aff91bb50bc5a53ecb5e6dd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 52
  2⤵
  - Program crash
  PID:2188

memory/2192-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2192-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download