d4c313375a11131f686687a7b34c635b9f8c443907f351855714e76669cd4b74

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 04:46

Target

d4c313375a11131f686687a7b34c635b9f8c443907f351855714e76669cd4b74.exe
Size

365KB
MD5

f4f1d914a8e901f145ee8d7096d59225
SHA1

94851b632568293dc50944fb5930508f7322b21b
SHA256

d4c313375a11131f686687a7b34c635b9f8c443907f351855714e76669cd4b74
SHA512

b7f608e09899a0b9bb1cfb4bc54d859823bcc5324895d771b5c98b8c8e3bcdc7c2338d91bd3df578a8918c4c499a89f2109efd26a4608ecf86a6d1ecc7b079ab
SSDEEP

6144:v/HzC/oYUa9+01ipzAOAcje7763TsBb+jUJaQq9AnCG+Zl:nHzqoYf9+Nzev63+0QqOn7E

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1056	1488	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1056	1488	d4c313375a11131f686687a7b34c635b9f8c443907f351855714e76669cd4b74.exe	26
PID 1488 wrote to memory of 1056	1488	d4c313375a11131f686687a7b34c635b9f8c443907f351855714e76669cd4b74.exe	26
PID 1488 wrote to memory of 1056	1488	d4c313375a11131f686687a7b34c635b9f8c443907f351855714e76669cd4b74.exe	26
PID 1488 wrote to memory of 1056	1488	d4c313375a11131f686687a7b34c635b9f8c443907f351855714e76669cd4b74.exe	26

C:\Users\Admin\AppData\Local\Temp\d4c313375a11131f686687a7b34c635b9f8c443907f351855714e76669cd4b74.exe
"C:\Users\Admin\AppData\Local\Temp\d4c313375a11131f686687a7b34c635b9f8c443907f351855714e76669cd4b74.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 220
  2⤵
  - Program crash
  PID:1056

memory/1488-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download