d0b22ea07ee59cff4f24e9094e3667d45d3853f3cd2c87a2b72509e8d0e4cccf

Analysis

max time kernel
34s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 12:29

Target

d0b22ea07ee59cff4f24e9094e3667d45d3853f3cd2c87a2b72509e8d0e4cccf.exe
Size

99KB
MD5

29e625612fabc60483964d1382868326
SHA1

759c65861c50fb29e28f60b539d2779fe4dcb6db
SHA256

d0b22ea07ee59cff4f24e9094e3667d45d3853f3cd2c87a2b72509e8d0e4cccf
SHA512

09836c6426b0e957591a28b7d3d6724384e87fd6279edd02cb4d9866f59b1ae644b8305e113ad59baae1bad2297cf175f27c2d1a55e6f55776a17c5740d6fc95
SSDEEP

3072:zlJ5pvutkHbJ9huiT433+anUV2p08Cy/1:vKOHtC36g1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1108	828	WerFault.exe	23

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 1108	828	d0b22ea07ee59cff4f24e9094e3667d45d3853f3cd2c87a2b72509e8d0e4cccf.exe	27
PID 828 wrote to memory of 1108	828	d0b22ea07ee59cff4f24e9094e3667d45d3853f3cd2c87a2b72509e8d0e4cccf.exe	27
PID 828 wrote to memory of 1108	828	d0b22ea07ee59cff4f24e9094e3667d45d3853f3cd2c87a2b72509e8d0e4cccf.exe	27
PID 828 wrote to memory of 1108	828	d0b22ea07ee59cff4f24e9094e3667d45d3853f3cd2c87a2b72509e8d0e4cccf.exe	27

C:\Users\Admin\AppData\Local\Temp\d0b22ea07ee59cff4f24e9094e3667d45d3853f3cd2c87a2b72509e8d0e4cccf.exe
"C:\Users\Admin\AppData\Local\Temp\d0b22ea07ee59cff4f24e9094e3667d45d3853f3cd2c87a2b72509e8d0e4cccf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 36
  2⤵
  - Program crash
  PID:1108

memory/828-55-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download