d70990a89b208dd4709647992e52008fbd7de3b340f79494458198da74841b49

Analysis

max time kernel
46s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 06:24

Target

d70990a89b208dd4709647992e52008fbd7de3b340f79494458198da74841b49.exe
Size

404KB
MD5

63d61038f0e02251285996ce3168b512
SHA1

4e1f1ea8fd29a95108158c55bbd6506a6ffc6842
SHA256

d70990a89b208dd4709647992e52008fbd7de3b340f79494458198da74841b49
SHA512

43988b758c2f98be73bdf748053ea5fc306dd607b393ce47b0adb41c2770d2986783d5d2147bb4e45a5204757ddff7d7dbac6502dae69aca26aa91c3625684bb
SSDEEP

6144:jw+hqgVrYb72q1XNflmtAQOMzIJDfVqVWoGR4Cw:XhBYf2qZNfl6rIJhqnVC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1972	1880	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 1972	1880	d70990a89b208dd4709647992e52008fbd7de3b340f79494458198da74841b49.exe	27
PID 1880 wrote to memory of 1972	1880	d70990a89b208dd4709647992e52008fbd7de3b340f79494458198da74841b49.exe	27
PID 1880 wrote to memory of 1972	1880	d70990a89b208dd4709647992e52008fbd7de3b340f79494458198da74841b49.exe	27
PID 1880 wrote to memory of 1972	1880	d70990a89b208dd4709647992e52008fbd7de3b340f79494458198da74841b49.exe	27

C:\Users\Admin\AppData\Local\Temp\d70990a89b208dd4709647992e52008fbd7de3b340f79494458198da74841b49.exe
"C:\Users\Admin\AppData\Local\Temp\d70990a89b208dd4709647992e52008fbd7de3b340f79494458198da74841b49.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 36
  2⤵
  - Program crash
  PID:1972

memory/1880-55-0x0000000000400000-0x0000000000465200-memory.dmp

Filesize
404KB

Download