1ddaa29d9abfb09a4923ae9b71a645b016d9c8b8f60c6294b2d487059a06758a

Analysis

max time kernel
16s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 16:41

Target

1ddaa29d9abfb09a4923ae9b71a645b016d9c8b8f60c6294b2d487059a06758a.exe
Size

754KB
MD5

6e0d26d4cf0dcd22d93916130cadd233
SHA1

483af7efbe0e8c4ae80bad7c2ab03b7dbca0b434
SHA256

1ddaa29d9abfb09a4923ae9b71a645b016d9c8b8f60c6294b2d487059a06758a
SHA512

8e8d49f09c3af5e0ccac1b47fb22e7575bceb7004f83ffd900c07bca198cbc2c9ef1bf5891830a0a7e746fb01b25dd128705f54d7c81944d432f312324b9f3bc
SSDEEP

12288:IQ77VbXViKvXMiDRVnEbH3J8cbvqvhtfFC15eYxz4z35jAznDMqyeQubPjs3i+LG:IY75dMF42

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1656 960 WerFault.exe 1ddaa29d9abfb09a4923ae9b71a645b016d9c8b8f60c6294b2d487059a06758a.exe

pid	pid_target	process	target process
1656	960	WerFault.exe	1ddaa29d9abfb09a4923ae9b71a645b016d9c8b8f60c6294b2d487059a06758a.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1ddaa29d9abfb09a4923ae9b71a645b016d9c8b8f60c6294b2d487059a06758a.exe

description	pid	process	target process
PID 960 wrote to memory of 1656	960	1ddaa29d9abfb09a4923ae9b71a645b016d9c8b8f60c6294b2d487059a06758a.exe	WerFault.exe
PID 960 wrote to memory of 1656	960	1ddaa29d9abfb09a4923ae9b71a645b016d9c8b8f60c6294b2d487059a06758a.exe	WerFault.exe
PID 960 wrote to memory of 1656	960	1ddaa29d9abfb09a4923ae9b71a645b016d9c8b8f60c6294b2d487059a06758a.exe	WerFault.exe
PID 960 wrote to memory of 1656	960	1ddaa29d9abfb09a4923ae9b71a645b016d9c8b8f60c6294b2d487059a06758a.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1ddaa29d9abfb09a4923ae9b71a645b016d9c8b8f60c6294b2d487059a06758a.exe
"C:\Users\Admin\AppData\Local\Temp\1ddaa29d9abfb09a4923ae9b71a645b016d9c8b8f60c6294b2d487059a06758a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 560
2⤵
- Program crash
PID:1656

memory/960-54-0x00000000011A0000-0x0000000001262000-memory.dmp

Filesize
776KB

Download
memory/1656-55-0x0000000000000000-mapping.dmp

Download