c2464ff7e92e79273f16fc3aca90b9e0d242d62b730a16f8ab57400c8fcf20d3

Analysis

max time kernel
10s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 17:08

Target

c2464ff7e92e79273f16fc3aca90b9e0d242d62b730a16f8ab57400c8fcf20d3.exe
Size

139KB
MD5

44f2f6e118ca403f881edbabc6d90fd6
SHA1

0025905f3e878f3c26d4aed407e5c9efc2300909
SHA256

c2464ff7e92e79273f16fc3aca90b9e0d242d62b730a16f8ab57400c8fcf20d3
SHA512

2bfed0b6854164b560118511760780ddb40951441fd9cfe72e7113f2eabfceee05999e22bb1b4f2dc53e93ea893131ab3fafcf6f9a6423cfce7c9797610fb9f5
SSDEEP

3072:boDK7KkOmqm2KX9F+eGa76BwdZzlf9phWya71zZX:kDK7KkB5XmBmTd77hrk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
852	1628	WerFault.exe	19

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 852	1628	c2464ff7e92e79273f16fc3aca90b9e0d242d62b730a16f8ab57400c8fcf20d3.exe	27
PID 1628 wrote to memory of 852	1628	c2464ff7e92e79273f16fc3aca90b9e0d242d62b730a16f8ab57400c8fcf20d3.exe	27
PID 1628 wrote to memory of 852	1628	c2464ff7e92e79273f16fc3aca90b9e0d242d62b730a16f8ab57400c8fcf20d3.exe	27
PID 1628 wrote to memory of 852	1628	c2464ff7e92e79273f16fc3aca90b9e0d242d62b730a16f8ab57400c8fcf20d3.exe	27

C:\Users\Admin\AppData\Local\Temp\c2464ff7e92e79273f16fc3aca90b9e0d242d62b730a16f8ab57400c8fcf20d3.exe
"C:\Users\Admin\AppData\Local\Temp\c2464ff7e92e79273f16fc3aca90b9e0d242d62b730a16f8ab57400c8fcf20d3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 88
  2⤵
  - Program crash
  PID:852