d3207acfb7743aa39bafe8d6f4459d25616e4137007098dc5c999fb6e92bcd03

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 07:59

Target

d3207acfb7743aa39bafe8d6f4459d25616e4137007098dc5c999fb6e92bcd03.exe
Size

28KB
MD5

7a374ee7d5e6f0e37d58bd4bc6afa5d3
SHA1

2956a685af27ffb5f861ef0b6b13c2d0b2730dee
SHA256

d3207acfb7743aa39bafe8d6f4459d25616e4137007098dc5c999fb6e92bcd03
SHA512

0a6150993130961554bba81937748a405996fbc1133f7de25ce6395de76a46b70d711dd423f43100765a9e5ce3143d6ca5de6a152c54fb73b60de33435bcb055
SSDEEP

192:aZiZkraWm4BQV5NNl4gKOt+poHVlXA7GPwFV5OzWq0u0Go21Y0r1hXu9Xq8NK0ox:aZAIeVLJKEuCwX5OzZ0u0VB03XupqkG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1672	1380	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 1672	1380	d3207acfb7743aa39bafe8d6f4459d25616e4137007098dc5c999fb6e92bcd03.exe	27
PID 1380 wrote to memory of 1672	1380	d3207acfb7743aa39bafe8d6f4459d25616e4137007098dc5c999fb6e92bcd03.exe	27
PID 1380 wrote to memory of 1672	1380	d3207acfb7743aa39bafe8d6f4459d25616e4137007098dc5c999fb6e92bcd03.exe	27
PID 1380 wrote to memory of 1672	1380	d3207acfb7743aa39bafe8d6f4459d25616e4137007098dc5c999fb6e92bcd03.exe	27

C:\Users\Admin\AppData\Local\Temp\d3207acfb7743aa39bafe8d6f4459d25616e4137007098dc5c999fb6e92bcd03.exe
"C:\Users\Admin\AppData\Local\Temp\d3207acfb7743aa39bafe8d6f4459d25616e4137007098dc5c999fb6e92bcd03.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 88
  2⤵
  - Program crash
  PID:1672

memory/1380-55-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download