d1f4cdf39eaebfad2b4bd92416d9baf44e7a1161957d785c86faf39aa339ad98

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 09:36

Target

d1f4cdf39eaebfad2b4bd92416d9baf44e7a1161957d785c86faf39aa339ad98.exe
Size

174KB
MD5

f0e79cf43b115660b274b975b11d95a2
SHA1

b594b6a5715dd69d16ad5390affda77fb412709c
SHA256

d1f4cdf39eaebfad2b4bd92416d9baf44e7a1161957d785c86faf39aa339ad98
SHA512

023c0cb27efac74740641e3de1c1c434fdff530336b5ea104e721ce76a90ddd4b095a804c0f95d17a6139a988dc12ff7888e4fb2ed0d0563a65ece194ecf0fcd
SSDEEP

3072:Q4nYxtXDdVFr/MSTMdhEZ23g+BIyc9WtwAT2jXnUVUaf2eDPV7DnmmJvBT:jUZhxTBZUg+BK9XnU9fPDPVfRvt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
916	808	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 916	808	d1f4cdf39eaebfad2b4bd92416d9baf44e7a1161957d785c86faf39aa339ad98.exe	27
PID 808 wrote to memory of 916	808	d1f4cdf39eaebfad2b4bd92416d9baf44e7a1161957d785c86faf39aa339ad98.exe	27
PID 808 wrote to memory of 916	808	d1f4cdf39eaebfad2b4bd92416d9baf44e7a1161957d785c86faf39aa339ad98.exe	27
PID 808 wrote to memory of 916	808	d1f4cdf39eaebfad2b4bd92416d9baf44e7a1161957d785c86faf39aa339ad98.exe	27

C:\Users\Admin\AppData\Local\Temp\d1f4cdf39eaebfad2b4bd92416d9baf44e7a1161957d785c86faf39aa339ad98.exe
"C:\Users\Admin\AppData\Local\Temp\d1f4cdf39eaebfad2b4bd92416d9baf44e7a1161957d785c86faf39aa339ad98.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 36
  2⤵
  - Program crash
  PID:916

memory/808-55-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download