6c2816a3e1b1daf687ee076248b212ec0e88fc6665b8a091d5f48cb90690a06d

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 04:31

Target

6c2816a3e1b1daf687ee076248b212ec0e88fc6665b8a091d5f48cb90690a06d.exe
Size

403KB
MD5

27794bda46e8ba63db18e975f74a08a6
SHA1

48755ef23a19f26ef40ad4e6fbf507d998733ce7
SHA256

6c2816a3e1b1daf687ee076248b212ec0e88fc6665b8a091d5f48cb90690a06d
SHA512

3211fdbb0a5c28e9028fd11e71f79dd80c0c064e090489194aed92b54570e23b3f2d7a5db191624927f2d466c68f0a6a27ae80ef5dada3f6f42c554345793ff7
SSDEEP

1536:BRs+7ugDRPw0MSosyfj2Uyc9X1zsYvmMGUEfDtQRUZf0dTQT6Vh68qdiNSt:0YPw0MSVyj2VkJ8ZUcJQRvTXLTqdiN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1996	1980	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1996	1980	6c2816a3e1b1daf687ee076248b212ec0e88fc6665b8a091d5f48cb90690a06d.exe	28
PID 1980 wrote to memory of 1996	1980	6c2816a3e1b1daf687ee076248b212ec0e88fc6665b8a091d5f48cb90690a06d.exe	28
PID 1980 wrote to memory of 1996	1980	6c2816a3e1b1daf687ee076248b212ec0e88fc6665b8a091d5f48cb90690a06d.exe	28
PID 1980 wrote to memory of 1996	1980	6c2816a3e1b1daf687ee076248b212ec0e88fc6665b8a091d5f48cb90690a06d.exe	28

C:\Users\Admin\AppData\Local\Temp\6c2816a3e1b1daf687ee076248b212ec0e88fc6665b8a091d5f48cb90690a06d.exe
"C:\Users\Admin\AppData\Local\Temp\6c2816a3e1b1daf687ee076248b212ec0e88fc6665b8a091d5f48cb90690a06d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 36
  2⤵
  - Program crash
  PID:1996

memory/1980-55-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download