dcff1d2bd8c93a11c3065a49c6b55ad8cc1ae07409fc99ae4f9bb35c99cdfb95

Analysis

max time kernel
3s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23/11/2022, 21:10

Target

dcff1d2bd8c93a11c3065a49c6b55ad8cc1ae07409fc99ae4f9bb35c99cdfb95.exe
Size

331KB
MD5

77d778319081b069ac0380cfe6f46fc0
SHA1

9c7c72866246a37bee5b106189351d286b6c7c35
SHA256

dcff1d2bd8c93a11c3065a49c6b55ad8cc1ae07409fc99ae4f9bb35c99cdfb95
SHA512

5f0cfcf8f480aa775673a45634ed8df0ab8339720702e29740a0e0098b4f2488705e18925fc52f2fa7a12506a4064935de07c90e3918293c16be5adb8c205dcf
SSDEEP

1536:3b3Ua3LEwGS7bOWw/f98X1lIBn3fr9StJMu:Lb9SJ/f9wlc3D2J

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1284	844	WerFault.exe	22

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 1284	844	dcff1d2bd8c93a11c3065a49c6b55ad8cc1ae07409fc99ae4f9bb35c99cdfb95.exe	28
PID 844 wrote to memory of 1284	844	dcff1d2bd8c93a11c3065a49c6b55ad8cc1ae07409fc99ae4f9bb35c99cdfb95.exe	28
PID 844 wrote to memory of 1284	844	dcff1d2bd8c93a11c3065a49c6b55ad8cc1ae07409fc99ae4f9bb35c99cdfb95.exe	28
PID 844 wrote to memory of 1284	844	dcff1d2bd8c93a11c3065a49c6b55ad8cc1ae07409fc99ae4f9bb35c99cdfb95.exe	28

C:\Users\Admin\AppData\Local\Temp\dcff1d2bd8c93a11c3065a49c6b55ad8cc1ae07409fc99ae4f9bb35c99cdfb95.exe
"C:\Users\Admin\AppData\Local\Temp\dcff1d2bd8c93a11c3065a49c6b55ad8cc1ae07409fc99ae4f9bb35c99cdfb95.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 844 -s 152
  2⤵
  - Program crash
  PID:1284

memory/844-54-0x0000000075011000-0x0000000075013000-memory.dmp

Filesize
8KB

Download
memory/844-56-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download