d0b3d2cd71f8149959236be0d17e4fbac7f3e67da5cf95214e684f25f9765c67

Analysis

max time kernel
43s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 01:57

Target

d0b3d2cd71f8149959236be0d17e4fbac7f3e67da5cf95214e684f25f9765c67.exe
Size

208KB
MD5

fdf7381c79fc964c4030815082d4fdbd
SHA1

d436c0d3985527cbf8c7affab5caf709ab871640
SHA256

d0b3d2cd71f8149959236be0d17e4fbac7f3e67da5cf95214e684f25f9765c67
SHA512

8386b5852ca0e46f0e9f37eee757e49033757575fedf53f6df55c1ab4dd89408112e13b289d5d6f8091386476366d676ea3294805d8b33e9498a244b99d8716a
SSDEEP

1536:9C+87y+HgYMF434xld9YLU9KD02BxAcK9SPoYZwA1d:9ChJgYMm4xf9cU9KQ2BxA59SPMS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1748	1484	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 1748	1484	d0b3d2cd71f8149959236be0d17e4fbac7f3e67da5cf95214e684f25f9765c67.exe	27
PID 1484 wrote to memory of 1748	1484	d0b3d2cd71f8149959236be0d17e4fbac7f3e67da5cf95214e684f25f9765c67.exe	27
PID 1484 wrote to memory of 1748	1484	d0b3d2cd71f8149959236be0d17e4fbac7f3e67da5cf95214e684f25f9765c67.exe	27
PID 1484 wrote to memory of 1748	1484	d0b3d2cd71f8149959236be0d17e4fbac7f3e67da5cf95214e684f25f9765c67.exe	27

C:\Users\Admin\AppData\Local\Temp\d0b3d2cd71f8149959236be0d17e4fbac7f3e67da5cf95214e684f25f9765c67.exe
"C:\Users\Admin\AppData\Local\Temp\d0b3d2cd71f8149959236be0d17e4fbac7f3e67da5cf95214e684f25f9765c67.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 36
  2⤵
  - Program crash
  PID:1748

memory/1484-55-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download