d84145f48434cea7b7d8a1e7271b3dc168c8b670b55ad0cfa735d81a57968574

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 03:58

Target

d84145f48434cea7b7d8a1e7271b3dc168c8b670b55ad0cfa735d81a57968574.exe
Size

147KB
MD5

3cfd541588e2500797b01a455b952e08
SHA1

a999f4623457f71d9b3e4375a439c7cb3c9cad5a
SHA256

d84145f48434cea7b7d8a1e7271b3dc168c8b670b55ad0cfa735d81a57968574
SHA512

489929ddafbf94dc297d11c6ec449bed6878645756a193aaa0bd2b502fd7ccd93a71ad3d5ee42b13d0d8809919a04e1f3be72031133321448d0486ef760c82cb
SSDEEP

3072:5uGYQ7YbPT1zwLv5V8vSFaW/rs9b+GUN3OAv0XC1+4X27jL5SeG:QG1I1zG8aF+b+GI3FvyC1FX2XFSeG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
952	1396	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 952	1396	d84145f48434cea7b7d8a1e7271b3dc168c8b670b55ad0cfa735d81a57968574.exe	27
PID 1396 wrote to memory of 952	1396	d84145f48434cea7b7d8a1e7271b3dc168c8b670b55ad0cfa735d81a57968574.exe	27
PID 1396 wrote to memory of 952	1396	d84145f48434cea7b7d8a1e7271b3dc168c8b670b55ad0cfa735d81a57968574.exe	27
PID 1396 wrote to memory of 952	1396	d84145f48434cea7b7d8a1e7271b3dc168c8b670b55ad0cfa735d81a57968574.exe	27

C:\Users\Admin\AppData\Local\Temp\d84145f48434cea7b7d8a1e7271b3dc168c8b670b55ad0cfa735d81a57968574.exe
"C:\Users\Admin\AppData\Local\Temp\d84145f48434cea7b7d8a1e7271b3dc168c8b670b55ad0cfa735d81a57968574.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 36
  2⤵
  - Program crash
  PID:952

memory/1396-55-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download