dbf0f7b7dceb5387947454f97229a306d8d1c46b54a70d6781cf2d6c98827092

Analysis

max time kernel
83s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
07-12-2022 02:27

Target

dbf0f7b7dceb5387947454f97229a306d8d1c46b54a70d6781cf2d6c98827092.exe
Size

30KB
MD5

930fb2f598ed06ddf6f15df6758e3ba4
SHA1

dbb3b3bfc7f5c31aede4a09f4a523b9473974a17
SHA256

dbf0f7b7dceb5387947454f97229a306d8d1c46b54a70d6781cf2d6c98827092
SHA512

07807f2a594111c24f95631918b6cee781b1e31b8a44286e83c543f3ffd746b3ba5ab6a0ff2a8cdc09d0604272faab79f07859ebc1908fb5db9c2823373b0e14
SSDEEP

768:mPrhdKGiOBEPCRjzyeBbH4no8qwCEgvI1Y7PQGTIF:mPrhdAEnhbR8qwCELwPQG0F

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
568	1484	WerFault.exe	20

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 568	1484	dbf0f7b7dceb5387947454f97229a306d8d1c46b54a70d6781cf2d6c98827092.exe	28
PID 1484 wrote to memory of 568	1484	dbf0f7b7dceb5387947454f97229a306d8d1c46b54a70d6781cf2d6c98827092.exe	28
PID 1484 wrote to memory of 568	1484	dbf0f7b7dceb5387947454f97229a306d8d1c46b54a70d6781cf2d6c98827092.exe	28
PID 1484 wrote to memory of 568	1484	dbf0f7b7dceb5387947454f97229a306d8d1c46b54a70d6781cf2d6c98827092.exe	28

C:\Users\Admin\AppData\Local\Temp\dbf0f7b7dceb5387947454f97229a306d8d1c46b54a70d6781cf2d6c98827092.exe
"C:\Users\Admin\AppData\Local\Temp\dbf0f7b7dceb5387947454f97229a306d8d1c46b54a70d6781cf2d6c98827092.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 36
  2⤵
  - Program crash
  PID:568

memory/568-55-0x0000000000000000-mapping.dmp

Download
memory/1484-54-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download