d3752092260b971fbfc318e7bf80877a7c8b4de523cbde341be119da4f308829

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 17:28

Target

d3752092260b971fbfc318e7bf80877a7c8b4de523cbde341be119da4f308829.exe
Size

158KB
MD5

074ada3318fa43f81e22e3f43acdae5d
SHA1

3d0e895bd56f981ebe0a8cc996d1f18393b56ac9
SHA256

d3752092260b971fbfc318e7bf80877a7c8b4de523cbde341be119da4f308829
SHA512

0913c62b51e534063e0d7003345813545a7629830e7122a2f203c134c1399ddeaf658cc10602dbb6c5765942b118d23e927146707efd507d6ab0ff01229a9cbe
SSDEEP

3072:zb8LZp3na3e+VW0j56stI+HD6cop48HE/6rWseGDT1Z4/:X8LO356stl2HFE/6NX1i

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
948	1732	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 948	1732	d3752092260b971fbfc318e7bf80877a7c8b4de523cbde341be119da4f308829.exe	27
PID 1732 wrote to memory of 948	1732	d3752092260b971fbfc318e7bf80877a7c8b4de523cbde341be119da4f308829.exe	27
PID 1732 wrote to memory of 948	1732	d3752092260b971fbfc318e7bf80877a7c8b4de523cbde341be119da4f308829.exe	27
PID 1732 wrote to memory of 948	1732	d3752092260b971fbfc318e7bf80877a7c8b4de523cbde341be119da4f308829.exe	27

C:\Users\Admin\AppData\Local\Temp\d3752092260b971fbfc318e7bf80877a7c8b4de523cbde341be119da4f308829.exe
"C:\Users\Admin\AppData\Local\Temp\d3752092260b971fbfc318e7bf80877a7c8b4de523cbde341be119da4f308829.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 152
  2⤵
  - Program crash
  PID:948

memory/1732-54-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download