c81dc69a8b1e3f45e101dc4ba8de10330095ee9102a6d6c12be7baa1ba604d7b

Analysis

max time kernel
3s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 14:54

Target

c81dc69a8b1e3f45e101dc4ba8de10330095ee9102a6d6c12be7baa1ba604d7b.exe
Size

76KB
MD5

dc75afc48a9923fee752c5e035bc81ce
SHA1

a936d3e6f1e17ebe9828159f056a5c8d999fde22
SHA256

c81dc69a8b1e3f45e101dc4ba8de10330095ee9102a6d6c12be7baa1ba604d7b
SHA512

77b947f1a1c9f8c1a6859d3f883e062fb918e3e887fa3e77f0043379094a045da2d818e7485f3736784f55c9422c94d98c84275cb1798ca92041f5f67630d075
SSDEEP

1536:Hkkkk3GrUavBIUUa8INO3Y8K3I3r238ohV23PG38BpjVrs2ryrd1vUQuq6:Hkkkk3GrUa9J8Kcb2sohAJBHs2qo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1352	1228	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 1352	1228	c81dc69a8b1e3f45e101dc4ba8de10330095ee9102a6d6c12be7baa1ba604d7b.exe	28
PID 1228 wrote to memory of 1352	1228	c81dc69a8b1e3f45e101dc4ba8de10330095ee9102a6d6c12be7baa1ba604d7b.exe	28
PID 1228 wrote to memory of 1352	1228	c81dc69a8b1e3f45e101dc4ba8de10330095ee9102a6d6c12be7baa1ba604d7b.exe	28
PID 1228 wrote to memory of 1352	1228	c81dc69a8b1e3f45e101dc4ba8de10330095ee9102a6d6c12be7baa1ba604d7b.exe	28

C:\Users\Admin\AppData\Local\Temp\c81dc69a8b1e3f45e101dc4ba8de10330095ee9102a6d6c12be7baa1ba604d7b.exe
"C:\Users\Admin\AppData\Local\Temp\c81dc69a8b1e3f45e101dc4ba8de10330095ee9102a6d6c12be7baa1ba604d7b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 36
  2⤵
  - Program crash
  PID:1352

memory/1228-55-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1352-54-0x0000000000000000-mapping.dmp

Download