2dfd417769a29a246bb8403fbb7b5f2c8f10f1e0a5fcb4cf3c7280d51334e55a

Analysis

max time kernel
36s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 00:46

Target

2dfd417769a29a246bb8403fbb7b5f2c8f10f1e0a5fcb4cf3c7280d51334e55a.exe
Size

106KB
MD5

11f506b27e6d4b362f2485f17c949290
SHA1

1fd3ef898474dffc395fdd76ea31faa6fd718c37
SHA256

2dfd417769a29a246bb8403fbb7b5f2c8f10f1e0a5fcb4cf3c7280d51334e55a
SHA512

f6e3ddc438847eca3600510d0c3e004fead72e418eb1e9403aa9ffe17b0e3b5b191c54d09d0425915db08b24da128cd841f135a0d561631235381593d2825c35
SSDEEP

3072:0/3gB6dCIBUj3NC3WZXlfhywzJnqWNaN8b:FBTJC3WZt7J73

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
672	1344	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 672	1344	2dfd417769a29a246bb8403fbb7b5f2c8f10f1e0a5fcb4cf3c7280d51334e55a.exe	26
PID 1344 wrote to memory of 672	1344	2dfd417769a29a246bb8403fbb7b5f2c8f10f1e0a5fcb4cf3c7280d51334e55a.exe	26
PID 1344 wrote to memory of 672	1344	2dfd417769a29a246bb8403fbb7b5f2c8f10f1e0a5fcb4cf3c7280d51334e55a.exe	26
PID 1344 wrote to memory of 672	1344	2dfd417769a29a246bb8403fbb7b5f2c8f10f1e0a5fcb4cf3c7280d51334e55a.exe	26

C:\Users\Admin\AppData\Local\Temp\2dfd417769a29a246bb8403fbb7b5f2c8f10f1e0a5fcb4cf3c7280d51334e55a.exe
"C:\Users\Admin\AppData\Local\Temp\2dfd417769a29a246bb8403fbb7b5f2c8f10f1e0a5fcb4cf3c7280d51334e55a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 168
  2⤵
  - Program crash
  PID:672

memory/1344-54-0x0000000074F41000-0x0000000074F43000-memory.dmp

Filesize
8KB

Download
memory/1344-55-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download