d091cf2aeb565bc0f2d28c6a244df6b9cc30bf045d19b73cb995ca595f17e39b

Analysis

max time kernel
18s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 01:08

Target

d091cf2aeb565bc0f2d28c6a244df6b9cc30bf045d19b73cb995ca595f17e39b.exe
Size

173KB
MD5

075f6a91d1f428f2a5a114676072eba0
SHA1

32473e02f935d955d62b7c88fab71ac3dd46fba3
SHA256

d091cf2aeb565bc0f2d28c6a244df6b9cc30bf045d19b73cb995ca595f17e39b
SHA512

325fa0deb53d201cf0c8d46d6ebfed71fc2b6a99224ac48a248a1559cb8be628665fc0dc8788036c1ccf024c3c0ad82b3bb3b5058bf2570dd9d8af479560d4c2
SSDEEP

3072:VpzRNYuluupWyvbOijh7UAoaI52pySvl3nW0CWcscGF8ZHmt4qaC:VZRvupm9UX5WflXW5Wc88wG7C

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
856	308	WerFault.exe	21

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 308 wrote to memory of 856	308	d091cf2aeb565bc0f2d28c6a244df6b9cc30bf045d19b73cb995ca595f17e39b.exe	28
PID 308 wrote to memory of 856	308	d091cf2aeb565bc0f2d28c6a244df6b9cc30bf045d19b73cb995ca595f17e39b.exe	28
PID 308 wrote to memory of 856	308	d091cf2aeb565bc0f2d28c6a244df6b9cc30bf045d19b73cb995ca595f17e39b.exe	28
PID 308 wrote to memory of 856	308	d091cf2aeb565bc0f2d28c6a244df6b9cc30bf045d19b73cb995ca595f17e39b.exe	28

C:\Users\Admin\AppData\Local\Temp\d091cf2aeb565bc0f2d28c6a244df6b9cc30bf045d19b73cb995ca595f17e39b.exe
"C:\Users\Admin\AppData\Local\Temp\d091cf2aeb565bc0f2d28c6a244df6b9cc30bf045d19b73cb995ca595f17e39b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:308
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 308 -s 96
  2⤵
  - Program crash
  PID:856