df671450578ac476419d1526541054c3d10f655f95987a19e253a2b2b2c6644c

Analysis

max time kernel
3s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:20

Target

df671450578ac476419d1526541054c3d10f655f95987a19e253a2b2b2c6644c.exe
Size

56KB
MD5

08847b8557cfa1f5a1aebb0b618d9301
SHA1

3e06319e2820d4cfea7a6c382ef38126f1c4e115
SHA256

df671450578ac476419d1526541054c3d10f655f95987a19e253a2b2b2c6644c
SHA512

000baca369cc9d9ac255a2fd586cd6e688e35d12b62d573c644d66d9fb087899623897a5d29d9113933f7867f81ef3b389e9a05ed709179080e1f1ca63a35356
SSDEEP

1536:IqBF6Rmz+yzV5QmyFvsg1sQtOUmCq8hSdO+6oeXbs1TI:nFEWDzV5gFvr1sQ8UmCq6jXbs1TI

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1380 1276 WerFault.exe df671450578ac476419d1526541054c3d10f655f95987a19e253a2b2b2c6644c.exe

pid	pid_target	process	target process
1380	1276	WerFault.exe	df671450578ac476419d1526541054c3d10f655f95987a19e253a2b2b2c6644c.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

df671450578ac476419d1526541054c3d10f655f95987a19e253a2b2b2c6644c.exe

description	pid	process	target process
PID 1276 wrote to memory of 1380	1276	df671450578ac476419d1526541054c3d10f655f95987a19e253a2b2b2c6644c.exe	WerFault.exe
PID 1276 wrote to memory of 1380	1276	df671450578ac476419d1526541054c3d10f655f95987a19e253a2b2b2c6644c.exe	WerFault.exe
PID 1276 wrote to memory of 1380	1276	df671450578ac476419d1526541054c3d10f655f95987a19e253a2b2b2c6644c.exe	WerFault.exe
PID 1276 wrote to memory of 1380	1276	df671450578ac476419d1526541054c3d10f655f95987a19e253a2b2b2c6644c.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\df671450578ac476419d1526541054c3d10f655f95987a19e253a2b2b2c6644c.exe
"C:\Users\Admin\AppData\Local\Temp\df671450578ac476419d1526541054c3d10f655f95987a19e253a2b2b2c6644c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 36
2⤵
- Program crash
PID:1380