d33b8f80cfeb6d139a27cc68d329bad6091ac29e4e758ba3bfa29e5887743f99

Analysis

max time kernel
3s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 18:36

Target

d33b8f80cfeb6d139a27cc68d329bad6091ac29e4e758ba3bfa29e5887743f99.exe
Size

534KB
MD5

1d8e97e1c06cfc6e6027355ac692a658
SHA1

ea018bbe277a1271104296cd07ee5e28f36b17d8
SHA256

d33b8f80cfeb6d139a27cc68d329bad6091ac29e4e758ba3bfa29e5887743f99
SHA512

58309f231fcc7f3c7dffb8eee84198ad730cb438e5dd7ae6ad1897ba42c3a28a00d7bbaec6d1d688bc983373fbcf6e07bfa6ea60920d3b3dbda5a7a3dcd15cfb
SSDEEP

12288:b9dhWtjNjlAMdv/sYNajJEDosr7JdodZisEjzLjdeWA6IYoGA:5cN5AisbjMLJdPsEX4WA6DoGA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1756	1264	WerFault.exe	27

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1264	d33b8f80cfeb6d139a27cc68d329bad6091ac29e4e758ba3bfa29e5887743f99.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 1756	1264	d33b8f80cfeb6d139a27cc68d329bad6091ac29e4e758ba3bfa29e5887743f99.exe	28
PID 1264 wrote to memory of 1756	1264	d33b8f80cfeb6d139a27cc68d329bad6091ac29e4e758ba3bfa29e5887743f99.exe	28
PID 1264 wrote to memory of 1756	1264	d33b8f80cfeb6d139a27cc68d329bad6091ac29e4e758ba3bfa29e5887743f99.exe	28
PID 1264 wrote to memory of 1756	1264	d33b8f80cfeb6d139a27cc68d329bad6091ac29e4e758ba3bfa29e5887743f99.exe	28

C:\Users\Admin\AppData\Local\Temp\d33b8f80cfeb6d139a27cc68d329bad6091ac29e4e758ba3bfa29e5887743f99.exe
"C:\Users\Admin\AppData\Local\Temp\d33b8f80cfeb6d139a27cc68d329bad6091ac29e4e758ba3bfa29e5887743f99.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 100
  2⤵
  - Program crash
  PID:1756

memory/1264-56-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1264-57-0x0000000000160000-0x000000000016E000-memory.dmp

Filesize
56KB

Download