dd3fde3469ce9281a2e0fa2ac6dbb00e4a6049f3e0157d25c4193bd5b86d1558

Analysis

max time kernel
54s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 02:08

Target

dd3fde3469ce9281a2e0fa2ac6dbb00e4a6049f3e0157d25c4193bd5b86d1558.exe
Size

32KB
MD5

62453c10ee7a6a83af22fe35d98371f5
SHA1

eef16c96818898b8456a8a7cbe287f69c638a526
SHA256

dd3fde3469ce9281a2e0fa2ac6dbb00e4a6049f3e0157d25c4193bd5b86d1558
SHA512

faa909dda7c340489f3c6a044fd2d623b0d537eb406c5c0861cd6118fe500d2df8133681a1d32d8e2b4368fe6f33fced9e81dc21fd3a514c024d6fc1b309ff17
SSDEEP

768:E/qF/LKI6oh244vibXEhOKEuLqbEO7fsO+cRv39gP8gwQKZEyuKk9jR9O:EqDKIB244KbEhOKEuLy7szc3q8fQYFiO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1448	1440	WerFault.exe	22

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 1448	1440	dd3fde3469ce9281a2e0fa2ac6dbb00e4a6049f3e0157d25c4193bd5b86d1558.exe	28
PID 1440 wrote to memory of 1448	1440	dd3fde3469ce9281a2e0fa2ac6dbb00e4a6049f3e0157d25c4193bd5b86d1558.exe	28
PID 1440 wrote to memory of 1448	1440	dd3fde3469ce9281a2e0fa2ac6dbb00e4a6049f3e0157d25c4193bd5b86d1558.exe	28
PID 1440 wrote to memory of 1448	1440	dd3fde3469ce9281a2e0fa2ac6dbb00e4a6049f3e0157d25c4193bd5b86d1558.exe	28

C:\Users\Admin\AppData\Local\Temp\dd3fde3469ce9281a2e0fa2ac6dbb00e4a6049f3e0157d25c4193bd5b86d1558.exe
"C:\Users\Admin\AppData\Local\Temp\dd3fde3469ce9281a2e0fa2ac6dbb00e4a6049f3e0157d25c4193bd5b86d1558.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 88
  2⤵
  - Program crash
  PID:1448

memory/1440-55-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download