db55e630884d29de91ef6e3d2a99a40305568d23282f7b047aca41f68c42204a

Analysis

max time kernel
43s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:19

Target

db55e630884d29de91ef6e3d2a99a40305568d23282f7b047aca41f68c42204a.exe
Size

3.4MB
MD5

64f5733c0424306e11231007374c9762
SHA1

ddbd0265599a2e33faba76b406fc9a1439d6a5a3
SHA256

db55e630884d29de91ef6e3d2a99a40305568d23282f7b047aca41f68c42204a
SHA512

ba25f450d73db986b5af6564b3ff4288e9eb37099630eee4729c6b324cda92ed36e227b0073d2206e1187bfa916a652345a999fd5ae7125613b939db758f3718
SSDEEP

49152:oGYLAOjuFkrTW0lWU38uT4onfQuaKSiRJCrliOE60liAB2vG:oDLuFWTfECBFCsuG

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

964 1868 WerFault.exe db55e630884d29de91ef6e3d2a99a40305568d23282f7b047aca41f68c42204a.exe

pid	pid_target	process	target process
964	1868	WerFault.exe	db55e630884d29de91ef6e3d2a99a40305568d23282f7b047aca41f68c42204a.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

db55e630884d29de91ef6e3d2a99a40305568d23282f7b047aca41f68c42204a.exe

description	pid	process	target process
PID 1868 wrote to memory of 964	1868	db55e630884d29de91ef6e3d2a99a40305568d23282f7b047aca41f68c42204a.exe	WerFault.exe
PID 1868 wrote to memory of 964	1868	db55e630884d29de91ef6e3d2a99a40305568d23282f7b047aca41f68c42204a.exe	WerFault.exe
PID 1868 wrote to memory of 964	1868	db55e630884d29de91ef6e3d2a99a40305568d23282f7b047aca41f68c42204a.exe	WerFault.exe
PID 1868 wrote to memory of 964	1868	db55e630884d29de91ef6e3d2a99a40305568d23282f7b047aca41f68c42204a.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\db55e630884d29de91ef6e3d2a99a40305568d23282f7b047aca41f68c42204a.exe
"C:\Users\Admin\AppData\Local\Temp\db55e630884d29de91ef6e3d2a99a40305568d23282f7b047aca41f68c42204a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 216
2⤵
- Program crash
PID:964

memory/964-56-0x0000000000000000-mapping.dmp

Download
memory/1868-54-0x0000000075021000-0x0000000075023000-memory.dmp

Filesize
8KB

Download
memory/1868-55-0x0000000000F40000-0x000000000128C000-memory.dmp

Filesize
3.3MB

Download