615f8e086f3472416a4abe5192685eeaed15dffcc34c612ea5cd2c69116cfd92

Analysis

max time kernel
34s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 06:44

Target

615f8e086f3472416a4abe5192685eeaed15dffcc34c612ea5cd2c69116cfd92.exe
Size

293KB
MD5

10889e4d4c95eacd8d419e57b464402d
SHA1

1c02ed9185395ec4763e5659a9dda5ef373e56a7
SHA256

615f8e086f3472416a4abe5192685eeaed15dffcc34c612ea5cd2c69116cfd92
SHA512

22bc3aea170e8a906bf1fdc78b66510604c49164d85162a3ec8b66a44ab34a62e1e12e74266d70e6241cf8c6ff32ef3f7739417b3110861bf91fa660d769c261
SSDEEP

6144:8mcD66RRj55JGmrpQsK3RDvu270jupCJsCxCa:NcD663kZvzkPaCxJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2028	980	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 980 wrote to memory of 2028	980	615f8e086f3472416a4abe5192685eeaed15dffcc34c612ea5cd2c69116cfd92.exe	15
PID 980 wrote to memory of 2028	980	615f8e086f3472416a4abe5192685eeaed15dffcc34c612ea5cd2c69116cfd92.exe	15
PID 980 wrote to memory of 2028	980	615f8e086f3472416a4abe5192685eeaed15dffcc34c612ea5cd2c69116cfd92.exe	15
PID 980 wrote to memory of 2028	980	615f8e086f3472416a4abe5192685eeaed15dffcc34c612ea5cd2c69116cfd92.exe	15

C:\Users\Admin\AppData\Local\Temp\615f8e086f3472416a4abe5192685eeaed15dffcc34c612ea5cd2c69116cfd92.exe
"C:\Users\Admin\AppData\Local\Temp\615f8e086f3472416a4abe5192685eeaed15dffcc34c612ea5cd2c69116cfd92.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 36
  2⤵
  - Program crash
  PID:2028