d278bc049d1a18a08d709a434c86868aea2825e7c32acf78ed6bb55fb7042f1c

Analysis

max time kernel
128s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 19:56

Target

d278bc049d1a18a08d709a434c86868aea2825e7c32acf78ed6bb55fb7042f1c.exe
Size

56KB
MD5

30a0c41c078996daa29cb6bb9e8d552e
SHA1

36ebc5189b8822ff98e901bac85e6fca56567d08
SHA256

d278bc049d1a18a08d709a434c86868aea2825e7c32acf78ed6bb55fb7042f1c
SHA512

326c183eea07318b2afd26cbcdf152ac5217d7cc565345f0cf2625def1a646732a4a460c1cfee728bb6b7a5a71e64db0e5398556398bfae5b14bf84c3f20f108
SSDEEP

768:w3SR4QZZirMj5kSaADVe61rguZXN8/vM7bkrefb9TqsDYbQ5TM1feJNTL:5bEYjvaAD8GXN+I7fJ+aCl1feD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
952	1820	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 952	1820	d278bc049d1a18a08d709a434c86868aea2825e7c32acf78ed6bb55fb7042f1c.exe	28
PID 1820 wrote to memory of 952	1820	d278bc049d1a18a08d709a434c86868aea2825e7c32acf78ed6bb55fb7042f1c.exe	28
PID 1820 wrote to memory of 952	1820	d278bc049d1a18a08d709a434c86868aea2825e7c32acf78ed6bb55fb7042f1c.exe	28
PID 1820 wrote to memory of 952	1820	d278bc049d1a18a08d709a434c86868aea2825e7c32acf78ed6bb55fb7042f1c.exe	28

C:\Users\Admin\AppData\Local\Temp\d278bc049d1a18a08d709a434c86868aea2825e7c32acf78ed6bb55fb7042f1c.exe
"C:\Users\Admin\AppData\Local\Temp\d278bc049d1a18a08d709a434c86868aea2825e7c32acf78ed6bb55fb7042f1c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 148
  2⤵
  - Program crash
  PID:952

memory/1820-54-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1820-56-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download