d1ef385370119b967d36992cc1326f9dcea8c323e1df49fc8b82fd0ae2929c32

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18/10/2022, 01:00

Target

d1ef385370119b967d36992cc1326f9dcea8c323e1df49fc8b82fd0ae2929c32.exe
Size

47KB
MD5

96513e84a37c884aebd0129efaea7ada
SHA1

5fe1d81ecc717377578e76a47112ceebe8236919
SHA256

d1ef385370119b967d36992cc1326f9dcea8c323e1df49fc8b82fd0ae2929c32
SHA512

35e97fca4ec87b470411a2d4313e7a37414c771d15d2e867547e6e8698e0f98d67797bcc3e1a1f4cc83cf8a857337665c2a374c560dba099055cd843c38f3418
SSDEEP

768:0ORCDtoFpeXbfo0HnhBaFRw4DIiyDWoKbjfFMAbmg0h4jMe+6hXiB77Hz:TCo7M18IKoat0OB+K+7T

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1028	1668	WerFault.exe	19

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1668	d1ef385370119b967d36992cc1326f9dcea8c323e1df49fc8b82fd0ae2929c32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1028	1668	d1ef385370119b967d36992cc1326f9dcea8c323e1df49fc8b82fd0ae2929c32.exe	28
PID 1668 wrote to memory of 1028	1668	d1ef385370119b967d36992cc1326f9dcea8c323e1df49fc8b82fd0ae2929c32.exe	28
PID 1668 wrote to memory of 1028	1668	d1ef385370119b967d36992cc1326f9dcea8c323e1df49fc8b82fd0ae2929c32.exe	28
PID 1668 wrote to memory of 1028	1668	d1ef385370119b967d36992cc1326f9dcea8c323e1df49fc8b82fd0ae2929c32.exe	28

C:\Users\Admin\AppData\Local\Temp\d1ef385370119b967d36992cc1326f9dcea8c323e1df49fc8b82fd0ae2929c32.exe
"C:\Users\Admin\AppData\Local\Temp\d1ef385370119b967d36992cc1326f9dcea8c323e1df49fc8b82fd0ae2929c32.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 124
  2⤵
  - Program crash
  PID:1028

memory/1668-55-0x0000000000020000-0x0000000000026000-memory.dmp

Filesize
24KB

Download