177bdf66f46a6b330c63eaef42af19cc821e40a315721287b1e2c496bce9f1cd

Analysis

max time kernel
34s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 03:19

Target

177bdf66f46a6b330c63eaef42af19cc821e40a315721287b1e2c496bce9f1cd.exe
Size

440KB
MD5

4031a890d66b601bb587bb92970461eb
SHA1

9b2da5605a928b76582a1c1c34de9867168befec
SHA256

177bdf66f46a6b330c63eaef42af19cc821e40a315721287b1e2c496bce9f1cd
SHA512

f1ec9665fb68907bfa20a55226bfde2041b0ec048ea57b1a05bec35363ff684892766f992af75a3f6a813c64e6b48c707abfef232d9adbe031b006b4ac0af4f6
SSDEEP

12288:DiPrgrDI/WzT0xH/MW/Wm7MDgTuaZxZMma:WDggpJt7kgqSM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1548	1468	WerFault.exe	18

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 1548	1468	177bdf66f46a6b330c63eaef42af19cc821e40a315721287b1e2c496bce9f1cd.exe	28
PID 1468 wrote to memory of 1548	1468	177bdf66f46a6b330c63eaef42af19cc821e40a315721287b1e2c496bce9f1cd.exe	28
PID 1468 wrote to memory of 1548	1468	177bdf66f46a6b330c63eaef42af19cc821e40a315721287b1e2c496bce9f1cd.exe	28
PID 1468 wrote to memory of 1548	1468	177bdf66f46a6b330c63eaef42af19cc821e40a315721287b1e2c496bce9f1cd.exe	28
PID 1468 wrote to memory of 1548	1468	177bdf66f46a6b330c63eaef42af19cc821e40a315721287b1e2c496bce9f1cd.exe	28
PID 1468 wrote to memory of 1548	1468	177bdf66f46a6b330c63eaef42af19cc821e40a315721287b1e2c496bce9f1cd.exe	28
PID 1468 wrote to memory of 1548	1468	177bdf66f46a6b330c63eaef42af19cc821e40a315721287b1e2c496bce9f1cd.exe	28

C:\Users\Admin\AppData\Local\Temp\177bdf66f46a6b330c63eaef42af19cc821e40a315721287b1e2c496bce9f1cd.exe
"C:\Users\Admin\AppData\Local\Temp\177bdf66f46a6b330c63eaef42af19cc821e40a315721287b1e2c496bce9f1cd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 268
  2⤵
  - Program crash
  PID:1548

memory/1468-54-0x0000000075211000-0x0000000075213000-memory.dmp

Filesize
8KB

Download
memory/1468-55-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1468-57-0x0000000000240000-0x00000000002AE000-memory.dmp

Filesize
440KB

Download
memory/1468-58-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download