df749fe6923e3030c5e15c1b132cf7dd958d38d19f1798aefa4b64e68e516c05

Analysis

max time kernel
18s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 07:33

Target

df749fe6923e3030c5e15c1b132cf7dd958d38d19f1798aefa4b64e68e516c05.exe
Size

76KB
MD5

80c849731690a33132d455d922af8864
SHA1

4e3887373a3789fb4e29cc0e13040d84b99a72bc
SHA256

df749fe6923e3030c5e15c1b132cf7dd958d38d19f1798aefa4b64e68e516c05
SHA512

f4702bd6523906ca1afe4af8da634ffd3831206dde2d091cca9cd99f1d500a937a1a8e5867af8dde757e95930de3fb22eb0f72ff45c65a9b7e89d3e8b7a7613e
SSDEEP

1536:oEThiODPgrSlESRXgqIowSufwFhwyuqN8z0H17NC8hntzpjVrs2ryrd1vUQuq6:o01XEaVwSAwFylhYH1Jb5Hs2qo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1724	1788	WerFault.exe	22

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 1724	1788	df749fe6923e3030c5e15c1b132cf7dd958d38d19f1798aefa4b64e68e516c05.exe	28
PID 1788 wrote to memory of 1724	1788	df749fe6923e3030c5e15c1b132cf7dd958d38d19f1798aefa4b64e68e516c05.exe	28
PID 1788 wrote to memory of 1724	1788	df749fe6923e3030c5e15c1b132cf7dd958d38d19f1798aefa4b64e68e516c05.exe	28
PID 1788 wrote to memory of 1724	1788	df749fe6923e3030c5e15c1b132cf7dd958d38d19f1798aefa4b64e68e516c05.exe	28

C:\Users\Admin\AppData\Local\Temp\df749fe6923e3030c5e15c1b132cf7dd958d38d19f1798aefa4b64e68e516c05.exe
"C:\Users\Admin\AppData\Local\Temp\df749fe6923e3030c5e15c1b132cf7dd958d38d19f1798aefa4b64e68e516c05.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 36
  2⤵
  - Program crash
  PID:1724

memory/1724-55-0x0000000000000000-mapping.dmp

Download
memory/1788-54-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download