d6bcc81a738e2768cd88c28179680381be4cfa6fc0852b6f353cf5c6743a1695

Analysis

max time kernel
43s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 13:24

Target

d6bcc81a738e2768cd88c28179680381be4cfa6fc0852b6f353cf5c6743a1695.exe
Size

196KB
MD5

3de47749ed2a14d47d43f4ac06542527
SHA1

1f7ad75b87bd562cbeb2ffbe17b24d47bee34928
SHA256

d6bcc81a738e2768cd88c28179680381be4cfa6fc0852b6f353cf5c6743a1695
SHA512

16e14dc0294f649b32dd7efb301a75258c8dce926d755372b16a783f8264ca2590859bac96df1828fdb15000a9ad4c7bcc42ef9e87acdeec4132bd876c7fc264
SSDEEP

6144:rylOvGLj4V93xEzqUiQ3Ro+a6iGZpd5XI4:6Ovl9BOq5Q3RdaZGZ+4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
844	1348	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 844	1348	d6bcc81a738e2768cd88c28179680381be4cfa6fc0852b6f353cf5c6743a1695.exe	27
PID 1348 wrote to memory of 844	1348	d6bcc81a738e2768cd88c28179680381be4cfa6fc0852b6f353cf5c6743a1695.exe	27
PID 1348 wrote to memory of 844	1348	d6bcc81a738e2768cd88c28179680381be4cfa6fc0852b6f353cf5c6743a1695.exe	27
PID 1348 wrote to memory of 844	1348	d6bcc81a738e2768cd88c28179680381be4cfa6fc0852b6f353cf5c6743a1695.exe	27

C:\Users\Admin\AppData\Local\Temp\d6bcc81a738e2768cd88c28179680381be4cfa6fc0852b6f353cf5c6743a1695.exe
"C:\Users\Admin\AppData\Local\Temp\d6bcc81a738e2768cd88c28179680381be4cfa6fc0852b6f353cf5c6743a1695.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 68
  2⤵
  - Program crash
  PID:844