fd08723b2c59953e32faf9aba41df48542a6feb93699d70ea1e4444a70569ae1

Analysis

max time kernel
33s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 21:23

Target

fd08723b2c59953e32faf9aba41df48542a6feb93699d70ea1e4444a70569ae1.exe
Size

97KB
MD5

050db50d18a1c4a5c1ac8fc9cbfb5797
SHA1

d098b95294a61b3cecc0b45f97750f3bfbb847cd
SHA256

fd08723b2c59953e32faf9aba41df48542a6feb93699d70ea1e4444a70569ae1
SHA512

7c367ca57a5ddd80fc87a07e2c54e4405a4dfafb374c0bdf2f48aa890c346774ee947ef34c0c068bc357fcc864bd8cedf047434270c4e6be835fa56df5c42d32
SSDEEP

1536:3zZdpp48ZP0lo+4EMMy18GO2uOSEowTwS1w6SjzvcmJoxDWqfINLa3cHa2B:jZElI/H1O2LSiTb+j7CEqfIy2B

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
804	1160	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 804	1160	fd08723b2c59953e32faf9aba41df48542a6feb93699d70ea1e4444a70569ae1.exe	27
PID 1160 wrote to memory of 804	1160	fd08723b2c59953e32faf9aba41df48542a6feb93699d70ea1e4444a70569ae1.exe	27
PID 1160 wrote to memory of 804	1160	fd08723b2c59953e32faf9aba41df48542a6feb93699d70ea1e4444a70569ae1.exe	27
PID 1160 wrote to memory of 804	1160	fd08723b2c59953e32faf9aba41df48542a6feb93699d70ea1e4444a70569ae1.exe	27

C:\Users\Admin\AppData\Local\Temp\fd08723b2c59953e32faf9aba41df48542a6feb93699d70ea1e4444a70569ae1.exe
"C:\Users\Admin\AppData\Local\Temp\fd08723b2c59953e32faf9aba41df48542a6feb93699d70ea1e4444a70569ae1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 168
  2⤵
  - Program crash
  PID:804

memory/804-55-0x0000000000000000-mapping.dmp

Download
memory/1160-54-0x00000000765B1000-0x00000000765B3000-memory.dmp

Filesize
8KB

Download
memory/1160-56-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download