0f1f172b993dee67fa4cf1792fe5b27584de02472db104e40a01ff69c9ebc3b5

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 07:32

Target

0f1f172b993dee67fa4cf1792fe5b27584de02472db104e40a01ff69c9ebc3b5.exe
Size

190KB
MD5

6a0719278a38e8d09ce1c4969a0bdb02
SHA1

9612faec7ef82dcdb25f2c550d4de1bf74c38eb1
SHA256

0f1f172b993dee67fa4cf1792fe5b27584de02472db104e40a01ff69c9ebc3b5
SHA512

b37b1461e5ab50271d3e00755290d1879394973d728322699379b4bcff5d8353c89cb5b5be40713ec72d5ee1208123f9a3670747d7b9aa0e1fb154eee81b129b
SSDEEP

3072:0P4FJYI3wIPthmNdPS/V87SAWYIT47MFdhMceV9dl8SNHWSJvfk3Gn7KmtoVYGXy:ZJYIPDml2APt7M/hMcMsYvfpoVYOs3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
552	1204	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 552	1204	0f1f172b993dee67fa4cf1792fe5b27584de02472db104e40a01ff69c9ebc3b5.exe	27
PID 1204 wrote to memory of 552	1204	0f1f172b993dee67fa4cf1792fe5b27584de02472db104e40a01ff69c9ebc3b5.exe	27
PID 1204 wrote to memory of 552	1204	0f1f172b993dee67fa4cf1792fe5b27584de02472db104e40a01ff69c9ebc3b5.exe	27
PID 1204 wrote to memory of 552	1204	0f1f172b993dee67fa4cf1792fe5b27584de02472db104e40a01ff69c9ebc3b5.exe	27

C:\Users\Admin\AppData\Local\Temp\0f1f172b993dee67fa4cf1792fe5b27584de02472db104e40a01ff69c9ebc3b5.exe
"C:\Users\Admin\AppData\Local\Temp\0f1f172b993dee67fa4cf1792fe5b27584de02472db104e40a01ff69c9ebc3b5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 88
  2⤵
  - Program crash
  PID:552