1dd31a5da40558e1ca6561ad4bba8c6d8d1a7ef78022ee6ffc312a06fc9c037f

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
12/10/2022, 14:19

Target

1dd31a5da40558e1ca6561ad4bba8c6d8d1a7ef78022ee6ffc312a06fc9c037f.exe
Size

173KB
MD5

6bc558dbae10e11d2de75cd6a093ac70
SHA1

5f7fef19e15d3b4ed05055e90aeb1d22e1a00399
SHA256

1dd31a5da40558e1ca6561ad4bba8c6d8d1a7ef78022ee6ffc312a06fc9c037f
SHA512

fface79452cf8ad4f3dbc1ce9846fb27714e30aced77f056b9a50055ff44bec11ac2f5c4a374087c5b99493a0ebc27880e79eac9e878504adc15247f66b4e0d0
SSDEEP

3072:1pzRNYuluupWyvbOijh7UAoaI52pySvl3nW0CWcscGF8ZHmt4qZrO:1ZRvupm9UX5WflXW5Wc88wGMrO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1224	1416	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 1224	1416	1dd31a5da40558e1ca6561ad4bba8c6d8d1a7ef78022ee6ffc312a06fc9c037f.exe	27
PID 1416 wrote to memory of 1224	1416	1dd31a5da40558e1ca6561ad4bba8c6d8d1a7ef78022ee6ffc312a06fc9c037f.exe	27
PID 1416 wrote to memory of 1224	1416	1dd31a5da40558e1ca6561ad4bba8c6d8d1a7ef78022ee6ffc312a06fc9c037f.exe	27
PID 1416 wrote to memory of 1224	1416	1dd31a5da40558e1ca6561ad4bba8c6d8d1a7ef78022ee6ffc312a06fc9c037f.exe	27

C:\Users\Admin\AppData\Local\Temp\1dd31a5da40558e1ca6561ad4bba8c6d8d1a7ef78022ee6ffc312a06fc9c037f.exe
"C:\Users\Admin\AppData\Local\Temp\1dd31a5da40558e1ca6561ad4bba8c6d8d1a7ef78022ee6ffc312a06fc9c037f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1416 -s 96
  2⤵
  - Program crash
  PID:1224