67da9b04f9d9b2d8468f529d6b8397e252f3772851e6481665e094058a34c2c4

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 06:04

Target

67da9b04f9d9b2d8468f529d6b8397e252f3772851e6481665e094058a34c2c4.exe
Size

61KB
MD5

215d01caef5c29e27a3d62b514a511fb
SHA1

f0df923eb2d9fea346d6a3769355df959ea3f414
SHA256

67da9b04f9d9b2d8468f529d6b8397e252f3772851e6481665e094058a34c2c4
SHA512

2e3fc1572e969adc1c3284fad8614f7845418a4a774b7b4da4de910c802e05d57f99265cc3bbaf4667e4211b5a57ba5fe6668df28d6233795fcc2a848fb57f72
SSDEEP

1536:NeoRlSaw8WQGrAVUHn6WCm4ljedV1eG/PMAsEJMQW5L:Ne+4iXG4UH6dm4l0eG/PtsEqQWx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
748	288	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 288 wrote to memory of 748	288	67da9b04f9d9b2d8468f529d6b8397e252f3772851e6481665e094058a34c2c4.exe	28
PID 288 wrote to memory of 748	288	67da9b04f9d9b2d8468f529d6b8397e252f3772851e6481665e094058a34c2c4.exe	28
PID 288 wrote to memory of 748	288	67da9b04f9d9b2d8468f529d6b8397e252f3772851e6481665e094058a34c2c4.exe	28
PID 288 wrote to memory of 748	288	67da9b04f9d9b2d8468f529d6b8397e252f3772851e6481665e094058a34c2c4.exe	28

C:\Users\Admin\AppData\Local\Temp\67da9b04f9d9b2d8468f529d6b8397e252f3772851e6481665e094058a34c2c4.exe
"C:\Users\Admin\AppData\Local\Temp\67da9b04f9d9b2d8468f529d6b8397e252f3772851e6481665e094058a34c2c4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 288 -s 36
  2⤵
  - Program crash
  PID:748

memory/288-55-0x0000000000400000-0x0000000000425489-memory.dmp

Filesize
149KB

Download