dfd4698fdac4cf87f6f93b8b7269c1547eae55324f1dac556f7882303effd1c5

Analysis

max time kernel
42s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-10-2022 09:51

Target

dfd4698fdac4cf87f6f93b8b7269c1547eae55324f1dac556f7882303effd1c5.exe
Size

281KB
MD5

5b013457a15cfa57d0e8f651b84d5c35
SHA1

20e229a097a00dfe7f7981bd2ea554e9a2a8e0d8
SHA256

dfd4698fdac4cf87f6f93b8b7269c1547eae55324f1dac556f7882303effd1c5
SHA512

c5f71969f1fa901357881f9d4067c60824e6436a261af9f875b12bc02f6b62478358352c48bde6a47a7171e61c544684e6444779bc1e95eaba56e82646c39a53
SSDEEP

6144:Al5rxCff+b2SdvY9wvP6bQ7yMP+DE827I2GNSKNftr:AzNCf2Ky6b7MP+Dd2UaKnr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1908	1112	WerFault.exe	23

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 1908	1112	dfd4698fdac4cf87f6f93b8b7269c1547eae55324f1dac556f7882303effd1c5.exe	28
PID 1112 wrote to memory of 1908	1112	dfd4698fdac4cf87f6f93b8b7269c1547eae55324f1dac556f7882303effd1c5.exe	28
PID 1112 wrote to memory of 1908	1112	dfd4698fdac4cf87f6f93b8b7269c1547eae55324f1dac556f7882303effd1c5.exe	28
PID 1112 wrote to memory of 1908	1112	dfd4698fdac4cf87f6f93b8b7269c1547eae55324f1dac556f7882303effd1c5.exe	28

C:\Users\Admin\AppData\Local\Temp\dfd4698fdac4cf87f6f93b8b7269c1547eae55324f1dac556f7882303effd1c5.exe
"C:\Users\Admin\AppData\Local\Temp\dfd4698fdac4cf87f6f93b8b7269c1547eae55324f1dac556f7882303effd1c5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 200
  2⤵
  - Program crash
  PID:1908

memory/1112-54-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/1112-55-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1112-57-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1908-56-0x0000000000000000-mapping.dmp

Download