dff540a47e7177350f40518a3c78c2f1bb42182fd0414908bf31e65df6e4db61

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 09:06

Target

dff540a47e7177350f40518a3c78c2f1bb42182fd0414908bf31e65df6e4db61.exe
Size

32KB
MD5

5bb0c925f44128d2b8123057894ba89d
SHA1

dbacff74d6569eb6e146eb78cdc0ee8ea446c672
SHA256

dff540a47e7177350f40518a3c78c2f1bb42182fd0414908bf31e65df6e4db61
SHA512

28702fdeb356e47855a74d860101b72ebd4c3d11c9be840528780ab40b80c32e5002404a5de1dd9912d9893b8c087381bffb223269eae7578d5d91445635897d
SSDEEP

768:kMjNqEHVROM4ETcUB71Jz+8dLOwfPbbG/wQyH:kINfF4ETcUB7Xz+8d9bb7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
3048	3040	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 3048	3040	dff540a47e7177350f40518a3c78c2f1bb42182fd0414908bf31e65df6e4db61.exe	1
PID 3040 wrote to memory of 3048	3040	dff540a47e7177350f40518a3c78c2f1bb42182fd0414908bf31e65df6e4db61.exe	1
PID 3040 wrote to memory of 3048	3040	dff540a47e7177350f40518a3c78c2f1bb42182fd0414908bf31e65df6e4db61.exe	1
PID 3040 wrote to memory of 3048	3040	dff540a47e7177350f40518a3c78c2f1bb42182fd0414908bf31e65df6e4db61.exe	1

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 44
1⤵
- Program crash
PID:3048

C:\Users\Admin\AppData\Local\Temp\dff540a47e7177350f40518a3c78c2f1bb42182fd0414908bf31e65df6e4db61.exe
"C:\Users\Admin\AppData\Local\Temp\dff540a47e7177350f40518a3c78c2f1bb42182fd0414908bf31e65df6e4db61.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3040