02d78bbec32d265fb8b6c4191e2ce96df42332f915da819d19663fd283e886a2

Analysis

max time kernel
35s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 23:51

Target

02d78bbec32d265fb8b6c4191e2ce96df42332f915da819d19663fd283e886a2.exe
Size

171KB
MD5

5db42a076e56ed573b4e6cead085f463
SHA1

11b69dbf46412382d5d61973721172c5346e5328
SHA256

02d78bbec32d265fb8b6c4191e2ce96df42332f915da819d19663fd283e886a2
SHA512

30b2ca4a6bcb719ec6680092833037417857a7de6928a1249b5300c55402783fdd2efefc0ed0ebafa899c1cdc12b660ee3f8cedb517450792020471280217a1a
SSDEEP

3072:U2NQKPWDyDRepJltZrpRSfHOCoChognPQ2ax9Iz9/scxLyJAU:HNSDyDRothpQ2CoIognlaxm9zw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
684	1192	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 684	1192	02d78bbec32d265fb8b6c4191e2ce96df42332f915da819d19663fd283e886a2.exe	27
PID 1192 wrote to memory of 684	1192	02d78bbec32d265fb8b6c4191e2ce96df42332f915da819d19663fd283e886a2.exe	27
PID 1192 wrote to memory of 684	1192	02d78bbec32d265fb8b6c4191e2ce96df42332f915da819d19663fd283e886a2.exe	27
PID 1192 wrote to memory of 684	1192	02d78bbec32d265fb8b6c4191e2ce96df42332f915da819d19663fd283e886a2.exe	27

C:\Users\Admin\AppData\Local\Temp\02d78bbec32d265fb8b6c4191e2ce96df42332f915da819d19663fd283e886a2.exe
"C:\Users\Admin\AppData\Local\Temp\02d78bbec32d265fb8b6c4191e2ce96df42332f915da819d19663fd283e886a2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 160
  2⤵
  - Program crash
  PID:684

memory/1192-54-0x0000000076701000-0x0000000076703000-memory.dmp

Filesize
8KB

Download
memory/1192-55-0x0000000001000000-0x0000000001028000-memory.dmp

Filesize
160KB

Download