db55ead06b034004345706945c8e12d9378eecd3dae1a821f2b2ad4938bae5d2

Analysis

max time kernel
37s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 00:01

Target

db55ead06b034004345706945c8e12d9378eecd3dae1a821f2b2ad4938bae5d2.exe
Size

171KB
MD5

6ad65d7419c606811524f41919dea198
SHA1

069d499ef683b583dd92b835690814bcc5932c9a
SHA256

db55ead06b034004345706945c8e12d9378eecd3dae1a821f2b2ad4938bae5d2
SHA512

874a12d4c288d0fe30f7a4785503b406c044713bcc1a0f47acd5466cc88f5b7ef0ca07d057badf57245bf2eded8b886a90ee0dcccb77acab89d2f8864e840609
SSDEEP

3072:RjKeO6oUs6tXQgY8wljEntiBj7hiI3qZrlFMg7BR63hvNlYCaxBxQoPTl7QmYAr:A9/h6tXJIjEujtiI3edT65IBNPB0m5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1580	1720	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1580	1720	db55ead06b034004345706945c8e12d9378eecd3dae1a821f2b2ad4938bae5d2.exe	27
PID 1720 wrote to memory of 1580	1720	db55ead06b034004345706945c8e12d9378eecd3dae1a821f2b2ad4938bae5d2.exe	27
PID 1720 wrote to memory of 1580	1720	db55ead06b034004345706945c8e12d9378eecd3dae1a821f2b2ad4938bae5d2.exe	27
PID 1720 wrote to memory of 1580	1720	db55ead06b034004345706945c8e12d9378eecd3dae1a821f2b2ad4938bae5d2.exe	27

C:\Users\Admin\AppData\Local\Temp\db55ead06b034004345706945c8e12d9378eecd3dae1a821f2b2ad4938bae5d2.exe
"C:\Users\Admin\AppData\Local\Temp\db55ead06b034004345706945c8e12d9378eecd3dae1a821f2b2ad4938bae5d2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 152
  2⤵
  - Program crash
  PID:1580

memory/1720-55-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download