d4336ecb95ee134fe55d76d26bbc8c613fac71d3211e214381fc647d663a3f44

Analysis

max time kernel
142s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 03:51

Target

d4336ecb95ee134fe55d76d26bbc8c613fac71d3211e214381fc647d663a3f44.exe
Size

575KB
MD5

80149cf668fd03a792d8905cc3848ef1
SHA1

904abbaab3261833844f41e31fc158d6c09a9482
SHA256

d4336ecb95ee134fe55d76d26bbc8c613fac71d3211e214381fc647d663a3f44
SHA512

3bdfccf29b32376ccbfbe4a32f18392574c5017cc0060100e97668494d15e48e1356e21f30f596c57a75465f531b95365a3f06cca59aecfc553149a461fc80c4
SSDEEP

12288:HPP6e45dikX9sl/QfmFLfUX1xQM64+rRkUOOea1N7WnK3ySsPdD:HPP6mhMv7Qrlea1N7WnK3ySo9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
996	1880	WerFault.exe	12

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 996	1880	d4336ecb95ee134fe55d76d26bbc8c613fac71d3211e214381fc647d663a3f44.exe	28
PID 1880 wrote to memory of 996	1880	d4336ecb95ee134fe55d76d26bbc8c613fac71d3211e214381fc647d663a3f44.exe	28
PID 1880 wrote to memory of 996	1880	d4336ecb95ee134fe55d76d26bbc8c613fac71d3211e214381fc647d663a3f44.exe	28
PID 1880 wrote to memory of 996	1880	d4336ecb95ee134fe55d76d26bbc8c613fac71d3211e214381fc647d663a3f44.exe	28

C:\Users\Admin\AppData\Local\Temp\d4336ecb95ee134fe55d76d26bbc8c613fac71d3211e214381fc647d663a3f44.exe
"C:\Users\Admin\AppData\Local\Temp\d4336ecb95ee134fe55d76d26bbc8c613fac71d3211e214381fc647d663a3f44.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 148
  2⤵
  - Program crash
  PID:996

memory/996-55-0x0000000000000000-mapping.dmp

Download
memory/1880-54-0x0000000000080000-0x0000000000115000-memory.dmp

Filesize
596KB

Download
memory/1880-56-0x0000000000080000-0x0000000000115000-memory.dmp

Filesize
596KB

Download