d226f07374e5b9b34b34ed5c71b70bec5acbd303288031d907420b1ae984df9b

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 06:13

Target

d226f07374e5b9b34b34ed5c71b70bec5acbd303288031d907420b1ae984df9b.exe
Size

63KB
MD5

31818bbb648c5321dcc571e8fe3bfc91
SHA1

8bef572afcf7762f678a8903bd64690001e9e431
SHA256

d226f07374e5b9b34b34ed5c71b70bec5acbd303288031d907420b1ae984df9b
SHA512

f94a55211f1555b2fafb72000b67d246e3437186565987808ccd9c0ea8a98079d56ef7ebd2d6269425f87b37646f1d11523b0b468ad439341a51fdaf535667f0
SSDEEP

768:hF7M4W7qhCErnPm+vCIPzSmw9UewkaLG2dmOJ//g0f6anae/dboivFyAo9/OUHkc:hFojLVh2RTd1gj/2dJNHo9//DJESXh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
856	1388	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 856	1388	d226f07374e5b9b34b34ed5c71b70bec5acbd303288031d907420b1ae984df9b.exe	27
PID 1388 wrote to memory of 856	1388	d226f07374e5b9b34b34ed5c71b70bec5acbd303288031d907420b1ae984df9b.exe	27
PID 1388 wrote to memory of 856	1388	d226f07374e5b9b34b34ed5c71b70bec5acbd303288031d907420b1ae984df9b.exe	27
PID 1388 wrote to memory of 856	1388	d226f07374e5b9b34b34ed5c71b70bec5acbd303288031d907420b1ae984df9b.exe	27

C:\Users\Admin\AppData\Local\Temp\d226f07374e5b9b34b34ed5c71b70bec5acbd303288031d907420b1ae984df9b.exe
"C:\Users\Admin\AppData\Local\Temp\d226f07374e5b9b34b34ed5c71b70bec5acbd303288031d907420b1ae984df9b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 36
  2⤵
  - Program crash
  PID:856

memory/1388-55-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download