d3d322da8e7ecfba88fc64da80ac870866ac37ac31adba1af6c7f00de841a295

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 07:59

Target

d3d322da8e7ecfba88fc64da80ac870866ac37ac31adba1af6c7f00de841a295.exe
Size

32KB
MD5

f478c1b5bd2f5bb0c4dbafd98637d9c4
SHA1

c3e2dcfefcc202c4b72d19a38da65795fd8f2d7f
SHA256

d3d322da8e7ecfba88fc64da80ac870866ac37ac31adba1af6c7f00de841a295
SHA512

500e0f6d58d1822c739963a85fb5b35da68f2df79a02a400a060ab09c46f44bbc15d70a516f5c5acb52102e797d864a969d3e0de28544ab664bf7e4b6cbffc46
SSDEEP

384:4EjZRS6ubx1gjIGbmWCUmZFKxz4FM2GVeSkgqdkH3pwmIapWntP:DuxxyHJCZcxCi2kXKapKP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1304	1128	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 1304	1128	d3d322da8e7ecfba88fc64da80ac870866ac37ac31adba1af6c7f00de841a295.exe	27
PID 1128 wrote to memory of 1304	1128	d3d322da8e7ecfba88fc64da80ac870866ac37ac31adba1af6c7f00de841a295.exe	27
PID 1128 wrote to memory of 1304	1128	d3d322da8e7ecfba88fc64da80ac870866ac37ac31adba1af6c7f00de841a295.exe	27
PID 1128 wrote to memory of 1304	1128	d3d322da8e7ecfba88fc64da80ac870866ac37ac31adba1af6c7f00de841a295.exe	27

C:\Users\Admin\AppData\Local\Temp\d3d322da8e7ecfba88fc64da80ac870866ac37ac31adba1af6c7f00de841a295.exe
"C:\Users\Admin\AppData\Local\Temp\d3d322da8e7ecfba88fc64da80ac870866ac37ac31adba1af6c7f00de841a295.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 88
  2⤵
  - Program crash
  PID:1304

memory/1128-55-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1304-54-0x0000000000000000-mapping.dmp

Download