db966970f102a91fbaaa354aa6caabeb67b2d65949bba5eaed1d3b2cd5d287e0

Analysis

max time kernel
105s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 04:00

Target

db966970f102a91fbaaa354aa6caabeb67b2d65949bba5eaed1d3b2cd5d287e0.exe
Size

209KB
MD5

63f117398ff0f9eae8d6e8b34682a00e
SHA1

77ca3fc6951bd707ef6fff3154c98a6193c7c01c
SHA256

db966970f102a91fbaaa354aa6caabeb67b2d65949bba5eaed1d3b2cd5d287e0
SHA512

d85b81e5959d24caf64dd4b1847c238ce09264730276cdc520e2a6a7b8469e670d31c7afad161969bec908e41ed9df07cc7fc26119ebb5cad6d12a53aa7dcd84
SSDEEP

3072:42aACAMfVxHsjqUwkMejsRk9dvR0FlgHIRXmUa9I1YcKmo8an5cy7Xrbyv7NB0P+:42dMQRvR0FZXp15KmOcabbU0PE99

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1976	1792	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 1976	1792	db966970f102a91fbaaa354aa6caabeb67b2d65949bba5eaed1d3b2cd5d287e0.exe	17
PID 1792 wrote to memory of 1976	1792	db966970f102a91fbaaa354aa6caabeb67b2d65949bba5eaed1d3b2cd5d287e0.exe	17
PID 1792 wrote to memory of 1976	1792	db966970f102a91fbaaa354aa6caabeb67b2d65949bba5eaed1d3b2cd5d287e0.exe	17
PID 1792 wrote to memory of 1976	1792	db966970f102a91fbaaa354aa6caabeb67b2d65949bba5eaed1d3b2cd5d287e0.exe	17

C:\Users\Admin\AppData\Local\Temp\db966970f102a91fbaaa354aa6caabeb67b2d65949bba5eaed1d3b2cd5d287e0.exe
"C:\Users\Admin\AppData\Local\Temp\db966970f102a91fbaaa354aa6caabeb67b2d65949bba5eaed1d3b2cd5d287e0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 128
  2⤵
  - Program crash
  PID:1976

memory/1792-55-0x000000002F9A0000-0x000000002F9D8000-memory.dmp

Filesize
224KB

Download