d892757de49418153afdbbbc521c345cc0bc45b69cae7cdb44ebb1a5f1a66d99

Analysis

max time kernel
39s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 00:04

Target

d892757de49418153afdbbbc521c345cc0bc45b69cae7cdb44ebb1a5f1a66d99.exe
Size

119KB
MD5

64c5cc19524fd2d8605f47fd4c41b50e
SHA1

a760a7b85d7942fd1f4c39e1b3c4ebcff54685cb
SHA256

d892757de49418153afdbbbc521c345cc0bc45b69cae7cdb44ebb1a5f1a66d99
SHA512

f7298b2739a82b0863a55f895e417c248c36d2277801258269d87866dd0e93daef156da1c1bfa4100114e5d90c426acab527983e9a3d0cfd2b43bd5548118b57
SSDEEP

1536:QjWbiTLie03QfktbjZMhw4zgeq9i+dB7AK6zd4GxDYt2zmdItzqGiVnRaSoY9zi1:030goXHVhPd6/Y6VqGiV4Rdht1cW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1948	2000	WerFault.exe	19

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1948	2000	d892757de49418153afdbbbc521c345cc0bc45b69cae7cdb44ebb1a5f1a66d99.exe	28
PID 2000 wrote to memory of 1948	2000	d892757de49418153afdbbbc521c345cc0bc45b69cae7cdb44ebb1a5f1a66d99.exe	28
PID 2000 wrote to memory of 1948	2000	d892757de49418153afdbbbc521c345cc0bc45b69cae7cdb44ebb1a5f1a66d99.exe	28
PID 2000 wrote to memory of 1948	2000	d892757de49418153afdbbbc521c345cc0bc45b69cae7cdb44ebb1a5f1a66d99.exe	28

C:\Users\Admin\AppData\Local\Temp\d892757de49418153afdbbbc521c345cc0bc45b69cae7cdb44ebb1a5f1a66d99.exe
"C:\Users\Admin\AppData\Local\Temp\d892757de49418153afdbbbc521c345cc0bc45b69cae7cdb44ebb1a5f1a66d99.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 36
  2⤵
  - Program crash
  PID:1948

memory/2000-55-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download