dbf443fda7d08778cf1c3e5d4485940098bcdc477a79b17f261e606a5ce1f66a

Analysis

max time kernel
8s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 17:23

Target

dbf443fda7d08778cf1c3e5d4485940098bcdc477a79b17f261e606a5ce1f66a.exe
Size

328KB
MD5

a3850c8236211fbffb0f7040b5589840
SHA1

1c156e189ed5c6e51d1474bcafbb60f9357ae804
SHA256

dbf443fda7d08778cf1c3e5d4485940098bcdc477a79b17f261e606a5ce1f66a
SHA512

cc8cad769dd3f04b9eb4fbc95a7d9aa1f3794ec7ee60c1735a539dee27d05c129cb1139ab2d0fb5076a094e49dc51e4ad1ae02df587bbb82b419c7ccb9ddb49c
SSDEEP

6144:PPeyxTBhJrfB3+pQ9POqLVJ5bbZXegqw48gyH0YtnbvK/kFZj:PPbZBhJrp31MWJtbZU8JFtrymB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1560	1756	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1560	1756	dbf443fda7d08778cf1c3e5d4485940098bcdc477a79b17f261e606a5ce1f66a.exe	28
PID 1756 wrote to memory of 1560	1756	dbf443fda7d08778cf1c3e5d4485940098bcdc477a79b17f261e606a5ce1f66a.exe	28
PID 1756 wrote to memory of 1560	1756	dbf443fda7d08778cf1c3e5d4485940098bcdc477a79b17f261e606a5ce1f66a.exe	28
PID 1756 wrote to memory of 1560	1756	dbf443fda7d08778cf1c3e5d4485940098bcdc477a79b17f261e606a5ce1f66a.exe	28

C:\Users\Admin\AppData\Local\Temp\dbf443fda7d08778cf1c3e5d4485940098bcdc477a79b17f261e606a5ce1f66a.exe
"C:\Users\Admin\AppData\Local\Temp\dbf443fda7d08778cf1c3e5d4485940098bcdc477a79b17f261e606a5ce1f66a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 92
  2⤵
  - Program crash
  PID:1560

memory/1560-55-0x0000000000000000-mapping.dmp

Download
memory/1756-54-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download