dc5dabc9e6d6ed6c4d0ee43b164b6014074f1142dc20358f1ef71a685d7dbd9e

Analysis

max time kernel
23s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 08:17

Target

dc5dabc9e6d6ed6c4d0ee43b164b6014074f1142dc20358f1ef71a685d7dbd9e.exe
Size

64KB
MD5

013ba30fd6f16c80033df168e1c60550
SHA1

126783cc66cec645adf45dacbadd8745eae2701d
SHA256

dc5dabc9e6d6ed6c4d0ee43b164b6014074f1142dc20358f1ef71a685d7dbd9e
SHA512

b66eb7d13d29c12adfd225eadb67a9819dfad8cf236ca6ed419f9e426493ad790772cf838a540fe92d415cfaeef784bc2dc025ba795296a9caf9e9dd99a77bf2
SSDEEP

1536:Nq/l8e8WtS0PFqPf+92R6DMqp3VGlF24d487jmnBNHgAz5ypC+6:c2e8WtS0PI+9TdPYF5487inDrz5ECF

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1492	1940	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 1492	1940	dc5dabc9e6d6ed6c4d0ee43b164b6014074f1142dc20358f1ef71a685d7dbd9e.exe	27
PID 1940 wrote to memory of 1492	1940	dc5dabc9e6d6ed6c4d0ee43b164b6014074f1142dc20358f1ef71a685d7dbd9e.exe	27
PID 1940 wrote to memory of 1492	1940	dc5dabc9e6d6ed6c4d0ee43b164b6014074f1142dc20358f1ef71a685d7dbd9e.exe	27
PID 1940 wrote to memory of 1492	1940	dc5dabc9e6d6ed6c4d0ee43b164b6014074f1142dc20358f1ef71a685d7dbd9e.exe	27

C:\Users\Admin\AppData\Local\Temp\dc5dabc9e6d6ed6c4d0ee43b164b6014074f1142dc20358f1ef71a685d7dbd9e.exe
"C:\Users\Admin\AppData\Local\Temp\dc5dabc9e6d6ed6c4d0ee43b164b6014074f1142dc20358f1ef71a685d7dbd9e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 36
  2⤵
  - Program crash
  PID:1492

memory/1940-55-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download