fd97a06a17401a4135f003ba97c977c24d3ee32e0bc8a0dd1c9812439fad927e

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 23:16

Target

fd97a06a17401a4135f003ba97c977c24d3ee32e0bc8a0dd1c9812439fad927e.exe
Size

174KB
MD5

0a57b452852ab64bafa5aa94a3bd36ba
SHA1

5a6b2a1b823dab099c9fa436c55a5b92ad1216cb
SHA256

fd97a06a17401a4135f003ba97c977c24d3ee32e0bc8a0dd1c9812439fad927e
SHA512

65fb3ccd22835f5186c042b16870fabc87aebacb9a6f7282d8fa4644cb2ea57a10b5f084be3ed95e42c350d9e68f36d5f8ba551fceaed09ed9c6f2e8a93f97a2
SSDEEP

3072:jL2s8Mps9j57BWEnxRxFjMn9q62F/WuIDoJn8oOiUrYZy25L:jyHYUun/Y/Wuzn8oJrZd5L

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1628	1504	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1628	1504	fd97a06a17401a4135f003ba97c977c24d3ee32e0bc8a0dd1c9812439fad927e.exe	27
PID 1504 wrote to memory of 1628	1504	fd97a06a17401a4135f003ba97c977c24d3ee32e0bc8a0dd1c9812439fad927e.exe	27
PID 1504 wrote to memory of 1628	1504	fd97a06a17401a4135f003ba97c977c24d3ee32e0bc8a0dd1c9812439fad927e.exe	27
PID 1504 wrote to memory of 1628	1504	fd97a06a17401a4135f003ba97c977c24d3ee32e0bc8a0dd1c9812439fad927e.exe	27

C:\Users\Admin\AppData\Local\Temp\fd97a06a17401a4135f003ba97c977c24d3ee32e0bc8a0dd1c9812439fad927e.exe
"C:\Users\Admin\AppData\Local\Temp\fd97a06a17401a4135f003ba97c977c24d3ee32e0bc8a0dd1c9812439fad927e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 92
  2⤵
  - Program crash
  PID:1628