d173f0530cb05b25b83dbaccd1e6871154f3747406a9cac772d4569e2f391424

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 04:02

Target

d173f0530cb05b25b83dbaccd1e6871154f3747406a9cac772d4569e2f391424.exe
Size

88KB
MD5

40206ed0e3938e8a5ffc62a6fca67d05
SHA1

6f32365499a3b49bce3aa5b7599b00c8f4e56171
SHA256

d173f0530cb05b25b83dbaccd1e6871154f3747406a9cac772d4569e2f391424
SHA512

e67fd92906c1d8916f00432cd6712694038044587a667a10722527ec9341c064250c37b89338aec4ba0974ea903c453271ef61f6de1ae4db4e566560cf34c78c
SSDEEP

1536:NbAb2IPeOjGCe9RcUbc1cyt2Ks/xt6dxh6JeEyX7h3t39:1tVZKsJt6daJeEyb9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1080	2016	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1080	2016	d173f0530cb05b25b83dbaccd1e6871154f3747406a9cac772d4569e2f391424.exe	26
PID 2016 wrote to memory of 1080	2016	d173f0530cb05b25b83dbaccd1e6871154f3747406a9cac772d4569e2f391424.exe	26
PID 2016 wrote to memory of 1080	2016	d173f0530cb05b25b83dbaccd1e6871154f3747406a9cac772d4569e2f391424.exe	26
PID 2016 wrote to memory of 1080	2016	d173f0530cb05b25b83dbaccd1e6871154f3747406a9cac772d4569e2f391424.exe	26

C:\Users\Admin\AppData\Local\Temp\d173f0530cb05b25b83dbaccd1e6871154f3747406a9cac772d4569e2f391424.exe
"C:\Users\Admin\AppData\Local\Temp\d173f0530cb05b25b83dbaccd1e6871154f3747406a9cac772d4569e2f391424.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 96
  2⤵
  - Program crash
  PID:1080