7d569dce8b963f540dae036bd22376ffceb0e76d3f409d16680462dd746dadc3

Analysis

max time kernel
9s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 22:41

Target

7d569dce8b963f540dae036bd22376ffceb0e76d3f409d16680462dd746dadc3.exe
Size

148KB
MD5

12b11be7383e72be2003ec983e0ffd49
SHA1

5c7ca10ce79424e6cb002338cd7657b16ad8899d
SHA256

7d569dce8b963f540dae036bd22376ffceb0e76d3f409d16680462dd746dadc3
SHA512

db5c4cfbe0912faf76307d922cc761ba3bb1d145bdafcaa828a2e2ab721ef7531497dfd790d44f71dd2290396634f13aaf717c7b3bb6b31feff2c1cac565697b
SSDEEP

3072:DEpLP8h7cjL9COvtV9tVrokaRp6ZqtwL4yt0Y:D267cv9CO1HTrGPjtMzl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1328	1144	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 1328	1144	7d569dce8b963f540dae036bd22376ffceb0e76d3f409d16680462dd746dadc3.exe	28
PID 1144 wrote to memory of 1328	1144	7d569dce8b963f540dae036bd22376ffceb0e76d3f409d16680462dd746dadc3.exe	28
PID 1144 wrote to memory of 1328	1144	7d569dce8b963f540dae036bd22376ffceb0e76d3f409d16680462dd746dadc3.exe	28
PID 1144 wrote to memory of 1328	1144	7d569dce8b963f540dae036bd22376ffceb0e76d3f409d16680462dd746dadc3.exe	28

C:\Users\Admin\AppData\Local\Temp\7d569dce8b963f540dae036bd22376ffceb0e76d3f409d16680462dd746dadc3.exe
"C:\Users\Admin\AppData\Local\Temp\7d569dce8b963f540dae036bd22376ffceb0e76d3f409d16680462dd746dadc3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1144 -s 116
  2⤵
  - Program crash
  PID:1328

memory/1144-54-0x0000000075F01000-0x0000000075F03000-memory.dmp

Filesize
8KB

Download
memory/1144-55-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download