bb0c1fd30c6878ff88a2f1433ec2c94f2062b1799ad4e60a2e41a3f46beb394b

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 15:02

Target

bb0c1fd30c6878ff88a2f1433ec2c94f2062b1799ad4e60a2e41a3f46beb394b.exe
Size

65KB
MD5

7a613d113e66ce0d3aa35893a8e15640
SHA1

ca05f3c1678dcdd6d5f289b86053ef6242ac9cb2
SHA256

bb0c1fd30c6878ff88a2f1433ec2c94f2062b1799ad4e60a2e41a3f46beb394b
SHA512

b6ca9357d8935b4d7df343c34b92bf76f76573a6fcaf21add3919bc1559ef093e52d98d3953b566f6a56801629f1aa1ec4ccd1ba6d6bc666901bf6b21d18f6ec
SSDEEP

1536:vQkVjEGb1BSrvnPeYJo9Vu3sQwsanTdgW/OQ/s1x3UM0+efcpsmu:4kVD1BSqao9c3HwsanTdgyOxsP+f+B

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1496	2016	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1496	2016	bb0c1fd30c6878ff88a2f1433ec2c94f2062b1799ad4e60a2e41a3f46beb394b.exe	27
PID 2016 wrote to memory of 1496	2016	bb0c1fd30c6878ff88a2f1433ec2c94f2062b1799ad4e60a2e41a3f46beb394b.exe	27
PID 2016 wrote to memory of 1496	2016	bb0c1fd30c6878ff88a2f1433ec2c94f2062b1799ad4e60a2e41a3f46beb394b.exe	27
PID 2016 wrote to memory of 1496	2016	bb0c1fd30c6878ff88a2f1433ec2c94f2062b1799ad4e60a2e41a3f46beb394b.exe	27

C:\Users\Admin\AppData\Local\Temp\bb0c1fd30c6878ff88a2f1433ec2c94f2062b1799ad4e60a2e41a3f46beb394b.exe
"C:\Users\Admin\AppData\Local\Temp\bb0c1fd30c6878ff88a2f1433ec2c94f2062b1799ad4e60a2e41a3f46beb394b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 92
  2⤵
  - Program crash
  PID:1496