ddc16329f7cf00e55a28c958433b488b61e755603db6bb2cbb0c661d3a6a2e36

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
02/11/2023, 04:35

Target

ddc16329f7cf00e55a28c958433b488b61e755603db6bb2cbb0c661d3a6a2e36.exe
Size

44KB
MD5

37fccf47809061e5122186ff958ae5d9
SHA1

0ed5fb4941d11c47bab7256803a737cf86295676
SHA256

ddc16329f7cf00e55a28c958433b488b61e755603db6bb2cbb0c661d3a6a2e36
SHA512

7b9e86e7be05ee921126358c7d23d9256cc8df931bda3fa1cee04e4616f46104f0725606cbaf168c1e0dcf041eccd78ed40524c7fbf15fe2d7e1d345d8583c19
SSDEEP

768:uIPpptawo4AAhsWCgpMFkwEDknXnymqduyrPoA/Y:dP9awxsWnpaGhol

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2868	2172	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2868	2172	ddc16329f7cf00e55a28c958433b488b61e755603db6bb2cbb0c661d3a6a2e36.exe	29
PID 2172 wrote to memory of 2868	2172	ddc16329f7cf00e55a28c958433b488b61e755603db6bb2cbb0c661d3a6a2e36.exe	29
PID 2172 wrote to memory of 2868	2172	ddc16329f7cf00e55a28c958433b488b61e755603db6bb2cbb0c661d3a6a2e36.exe	29
PID 2172 wrote to memory of 2868	2172	ddc16329f7cf00e55a28c958433b488b61e755603db6bb2cbb0c661d3a6a2e36.exe	29

C:\Users\Admin\AppData\Local\Temp\ddc16329f7cf00e55a28c958433b488b61e755603db6bb2cbb0c661d3a6a2e36.exe
"C:\Users\Admin\AppData\Local\Temp\ddc16329f7cf00e55a28c958433b488b61e755603db6bb2cbb0c661d3a6a2e36.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 132
  2⤵
  - Program crash
  PID:2868

memory/2172-0-0x0000000000090000-0x00000000000A6000-memory.dmp

Filesize
88KB

Download