f3dac92523b85fc51ba5b1ce7f57bbd039e949373698ccb55448bbbb4bf7beb9

Analysis

max time kernel
21s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 11:32

Target

f3dac92523b85fc51ba5b1ce7f57bbd039e949373698ccb55448bbbb4bf7beb9.exe
Size

47KB
MD5

434b262f81970b77b5dcc7a2107f7cbd
SHA1

b4dec1fae53b79c31212d2f8c03b2096c00a8669
SHA256

f3dac92523b85fc51ba5b1ce7f57bbd039e949373698ccb55448bbbb4bf7beb9
SHA512

8ea8dc39843d6c9232ce6270aca6def9691d4992984e72f99bedbe2e82b9fdf92b058b6ad9b40921541df5292f84d6125326d8cccbc61ff693a9fde4ed97f543
SSDEEP

768:D4CT83GBv3lJFvP+CWTDFEWbfObgeB+taO2u7NUm4Yrk:E2vRJQ9qbgeg0O28N3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
956	1792	WerFault.exe	9

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 956	1792	f3dac92523b85fc51ba5b1ce7f57bbd039e949373698ccb55448bbbb4bf7beb9.exe	28
PID 1792 wrote to memory of 956	1792	f3dac92523b85fc51ba5b1ce7f57bbd039e949373698ccb55448bbbb4bf7beb9.exe	28
PID 1792 wrote to memory of 956	1792	f3dac92523b85fc51ba5b1ce7f57bbd039e949373698ccb55448bbbb4bf7beb9.exe	28
PID 1792 wrote to memory of 956	1792	f3dac92523b85fc51ba5b1ce7f57bbd039e949373698ccb55448bbbb4bf7beb9.exe	28

C:\Users\Admin\AppData\Local\Temp\f3dac92523b85fc51ba5b1ce7f57bbd039e949373698ccb55448bbbb4bf7beb9.exe
"C:\Users\Admin\AppData\Local\Temp\f3dac92523b85fc51ba5b1ce7f57bbd039e949373698ccb55448bbbb4bf7beb9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 88
  2⤵
  - Program crash
  PID:956