dbc69e0e609451bea1d1224fa5899db0f0f90a4af19b1355acea8ad4a2efb25a

Analysis

max time kernel
144s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 11:55

Target

dbc69e0e609451bea1d1224fa5899db0f0f90a4af19b1355acea8ad4a2efb25a.exe
Size

130KB
MD5

968b6fd0b479181aeb1a18e598cc2080
SHA1

da63eef7ece8994a24dd94032c8180d80aef456e
SHA256

dbc69e0e609451bea1d1224fa5899db0f0f90a4af19b1355acea8ad4a2efb25a
SHA512

85192da201f4743c404769aeb55f82e2eedb28feefc8c7c44389d323274c82543db4c391b10f11eaf8c49f0165ce522e68f60721084454c250eb13fd0ed7a25a
SSDEEP

3072:pNQKPWDyWI0dJltZrpRjMIQV+WO0wcm+IJlUuKy2mLbTt:pNSDyWIqthpkVVO0BmFJurmx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
684	1644	WerFault.exe	9

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 684	1644	dbc69e0e609451bea1d1224fa5899db0f0f90a4af19b1355acea8ad4a2efb25a.exe	28
PID 1644 wrote to memory of 684	1644	dbc69e0e609451bea1d1224fa5899db0f0f90a4af19b1355acea8ad4a2efb25a.exe	28
PID 1644 wrote to memory of 684	1644	dbc69e0e609451bea1d1224fa5899db0f0f90a4af19b1355acea8ad4a2efb25a.exe	28
PID 1644 wrote to memory of 684	1644	dbc69e0e609451bea1d1224fa5899db0f0f90a4af19b1355acea8ad4a2efb25a.exe	28

C:\Users\Admin\AppData\Local\Temp\dbc69e0e609451bea1d1224fa5899db0f0f90a4af19b1355acea8ad4a2efb25a.exe
"C:\Users\Admin\AppData\Local\Temp\dbc69e0e609451bea1d1224fa5899db0f0f90a4af19b1355acea8ad4a2efb25a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 160
  2⤵
  - Program crash
  PID:684

memory/1644-54-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download
memory/1644-55-0x0000000001000000-0x0000000001024000-memory.dmp

Filesize
144KB

Download
memory/1644-57-0x0000000001000000-0x0000000001024000-memory.dmp

Filesize
144KB

Download