dc9df202ca036dd0b791bb4fed0e843cbf601f17be84b6911ba32057c022a70d

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 10:39

Target

dc9df202ca036dd0b791bb4fed0e843cbf601f17be84b6911ba32057c022a70d.exe
Size

32KB
MD5

808ae8e88b427f807409311343de48f9
SHA1

6247ed11380ec6e8e06625020d3d6243dc14e426
SHA256

dc9df202ca036dd0b791bb4fed0e843cbf601f17be84b6911ba32057c022a70d
SHA512

0a37390f98fbc5c597d0f68b3eb11d899ddd61681f3ff3a24473a34fe49304cc7a7db7807ef0712f16eb672e27a5b9218fc70717a563cf7a2a817d7ce8455594
SSDEEP

768:YTIpkiN5WQODlK7NgjAXKgGdoJHzRBcN1aLiCmvh45RyIWz:EIpkyWQfRUBm5R66Litvh45sz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
996	1720	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 996	1720	dc9df202ca036dd0b791bb4fed0e843cbf601f17be84b6911ba32057c022a70d.exe	27
PID 1720 wrote to memory of 996	1720	dc9df202ca036dd0b791bb4fed0e843cbf601f17be84b6911ba32057c022a70d.exe	27
PID 1720 wrote to memory of 996	1720	dc9df202ca036dd0b791bb4fed0e843cbf601f17be84b6911ba32057c022a70d.exe	27
PID 1720 wrote to memory of 996	1720	dc9df202ca036dd0b791bb4fed0e843cbf601f17be84b6911ba32057c022a70d.exe	27

C:\Users\Admin\AppData\Local\Temp\dc9df202ca036dd0b791bb4fed0e843cbf601f17be84b6911ba32057c022a70d.exe
"C:\Users\Admin\AppData\Local\Temp\dc9df202ca036dd0b791bb4fed0e843cbf601f17be84b6911ba32057c022a70d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 48
  2⤵
  - Program crash
  PID:996

memory/996-54-0x0000000000000000-mapping.dmp

Download
memory/1720-55-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download