1d2ba7c0d66f90988d157637e54a21a99c78d495eea9a3d09313f0afad2c9e0d

Analysis

max time kernel
35s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 06:36

Target

1d2ba7c0d66f90988d157637e54a21a99c78d495eea9a3d09313f0afad2c9e0d.exe
Size

570KB
MD5

34d72e433363b963087c0c48a6819b88
SHA1

62114d1afcb5744cecee18b1f05dc800bb2af8a7
SHA256

1d2ba7c0d66f90988d157637e54a21a99c78d495eea9a3d09313f0afad2c9e0d
SHA512

4d60b108f0262efadeab04466813a6012b5ffe2da541de01427ccf95b059d2d18b37f4300b6bb715e3fccbd3cc8eb815671bc1f1381f93cb7aa2a7fe45b76ad4
SSDEEP

12288:luBAivmmkyPVlBnSYc1AXJeObfpam6fP3g+nIxdLJ:QBAXRyhn3c6ZT6n7IxdLJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
904	1588	WerFault.exe	22

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 904	1588	1d2ba7c0d66f90988d157637e54a21a99c78d495eea9a3d09313f0afad2c9e0d.exe	27
PID 1588 wrote to memory of 904	1588	1d2ba7c0d66f90988d157637e54a21a99c78d495eea9a3d09313f0afad2c9e0d.exe	27
PID 1588 wrote to memory of 904	1588	1d2ba7c0d66f90988d157637e54a21a99c78d495eea9a3d09313f0afad2c9e0d.exe	27
PID 1588 wrote to memory of 904	1588	1d2ba7c0d66f90988d157637e54a21a99c78d495eea9a3d09313f0afad2c9e0d.exe	27

C:\Users\Admin\AppData\Local\Temp\1d2ba7c0d66f90988d157637e54a21a99c78d495eea9a3d09313f0afad2c9e0d.exe
"C:\Users\Admin\AppData\Local\Temp\1d2ba7c0d66f90988d157637e54a21a99c78d495eea9a3d09313f0afad2c9e0d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 168
  2⤵
  - Program crash
  PID:904

memory/1588-54-0x0000000075661000-0x0000000075663000-memory.dmp

Filesize
8KB

Download