d651b0368134121b41f792cc4065a591fd46ea66ac1c8f26598255a0d8467122

Analysis

max time kernel
24s
max time network
51s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 22:40

Target

d651b0368134121b41f792cc4065a591fd46ea66ac1c8f26598255a0d8467122.exe
Size

132KB
MD5

2ab0e758d93714252bf9069935b809d3
SHA1

33787d72f4c3944161408a75432530b4ae27f933
SHA256

d651b0368134121b41f792cc4065a591fd46ea66ac1c8f26598255a0d8467122
SHA512

56f3cae64251ada429357a74d06c44b97e9eb4df942a0c6bfb3704775fef0ca3ca5b13e5e6499302da3918f3ddb3cf7fbcfa9e8e2505950e761ff8ef0884c204
SSDEEP

3072:0iETrbvFatR91Tc7w3D83vOqmvwV+QBDgQvOn1fivmcAN2JHP:noEt31TcOD8bmv5UgBn1+P

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1296	976	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 976 wrote to memory of 1296	976	d651b0368134121b41f792cc4065a591fd46ea66ac1c8f26598255a0d8467122.exe	28
PID 976 wrote to memory of 1296	976	d651b0368134121b41f792cc4065a591fd46ea66ac1c8f26598255a0d8467122.exe	28
PID 976 wrote to memory of 1296	976	d651b0368134121b41f792cc4065a591fd46ea66ac1c8f26598255a0d8467122.exe	28
PID 976 wrote to memory of 1296	976	d651b0368134121b41f792cc4065a591fd46ea66ac1c8f26598255a0d8467122.exe	28

C:\Users\Admin\AppData\Local\Temp\d651b0368134121b41f792cc4065a591fd46ea66ac1c8f26598255a0d8467122.exe
"C:\Users\Admin\AppData\Local\Temp\d651b0368134121b41f792cc4065a591fd46ea66ac1c8f26598255a0d8467122.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 116
  2⤵
  - Program crash
  PID:1296

memory/976-54-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download