d26e6a08bec5a61119050f7673b70d193df040bf20c059d4679dd526bc6e0412

Analysis

max time kernel
38s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 03:51

Target

d26e6a08bec5a61119050f7673b70d193df040bf20c059d4679dd526bc6e0412.exe
Size

304KB
MD5

80547e5e1a5c5360695b617c35cec180
SHA1

f37332c4d6019fac21effab0ee4f13ca4399c5c9
SHA256

d26e6a08bec5a61119050f7673b70d193df040bf20c059d4679dd526bc6e0412
SHA512

dc4ede03867b3a1b9394ea101427e23cdddf7b71e85a0de97ed1cddd38880dbf0e1e4273273b682502c1fb385231d25eac3905c7968ebc71c59ce574df58a7b6
SSDEEP

6144:dRWSqVmRnfLSokPvVADEO8TBpUqzo0naGg:doSImRnjSoCQEOCBpUqPaGg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1980	1992	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1980	1992	d26e6a08bec5a61119050f7673b70d193df040bf20c059d4679dd526bc6e0412.exe	26
PID 1992 wrote to memory of 1980	1992	d26e6a08bec5a61119050f7673b70d193df040bf20c059d4679dd526bc6e0412.exe	26
PID 1992 wrote to memory of 1980	1992	d26e6a08bec5a61119050f7673b70d193df040bf20c059d4679dd526bc6e0412.exe	26
PID 1992 wrote to memory of 1980	1992	d26e6a08bec5a61119050f7673b70d193df040bf20c059d4679dd526bc6e0412.exe	26

C:\Users\Admin\AppData\Local\Temp\d26e6a08bec5a61119050f7673b70d193df040bf20c059d4679dd526bc6e0412.exe
"C:\Users\Admin\AppData\Local\Temp\d26e6a08bec5a61119050f7673b70d193df040bf20c059d4679dd526bc6e0412.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 92
  2⤵
  - Program crash
  PID:1980

memory/1992-55-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download