fd4ff4333892a5c4b6f2fcdd55ffe2e31780d5ebc59b674c9b173dbb98550dd6

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 11:44

Target

fd4ff4333892a5c4b6f2fcdd55ffe2e31780d5ebc59b674c9b173dbb98550dd6.exe
Size

90KB
MD5

0ee021d4948871b1dc537e759ff9dced
SHA1

bc04c03cc358b2b429c2b98c371b0205ff0911ae
SHA256

fd4ff4333892a5c4b6f2fcdd55ffe2e31780d5ebc59b674c9b173dbb98550dd6
SHA512

39c64862e8d1a6cad47a5d41e92ab093bd1f284363c043064f20b7fe565e088b932aba6f6f2f37439b58ea10ce6e64a6bd1f0e2a6ecd4c5d7387cae1da82a0f4
SSDEEP

1536:BERAH6Ws8VnFhEA+4K2E+9TqqaT2Se8fS02JzNn6FTx8kHV:CSaWs8VnYA+4Kr+9TqqaTRe4BOn6F

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
840	1000	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 840	1000	fd4ff4333892a5c4b6f2fcdd55ffe2e31780d5ebc59b674c9b173dbb98550dd6.exe	27
PID 1000 wrote to memory of 840	1000	fd4ff4333892a5c4b6f2fcdd55ffe2e31780d5ebc59b674c9b173dbb98550dd6.exe	27
PID 1000 wrote to memory of 840	1000	fd4ff4333892a5c4b6f2fcdd55ffe2e31780d5ebc59b674c9b173dbb98550dd6.exe	27
PID 1000 wrote to memory of 840	1000	fd4ff4333892a5c4b6f2fcdd55ffe2e31780d5ebc59b674c9b173dbb98550dd6.exe	27

C:\Users\Admin\AppData\Local\Temp\fd4ff4333892a5c4b6f2fcdd55ffe2e31780d5ebc59b674c9b173dbb98550dd6.exe
"C:\Users\Admin\AppData\Local\Temp\fd4ff4333892a5c4b6f2fcdd55ffe2e31780d5ebc59b674c9b173dbb98550dd6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 152
  2⤵
  - Program crash
  PID:840

memory/840-54-0x0000000000000000-mapping.dmp

Download
memory/1000-55-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download