f31d2ce12419de2f3c2a1601beaa8edd5cdde410229d5b7afeb2d0620c20f3ea

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 06:01

Target

f31d2ce12419de2f3c2a1601beaa8edd5cdde410229d5b7afeb2d0620c20f3ea.exe
Size

56KB
MD5

7987468b245965e8adab04605e817316
SHA1

bf8dc9c07be38d367e491d6fa417a0620ed6e45e
SHA256

f31d2ce12419de2f3c2a1601beaa8edd5cdde410229d5b7afeb2d0620c20f3ea
SHA512

6a0483bb2514e42e6a44f36a0546db9a02ab8d7ebc5152bfe593cab6adc71adad9b5e78c22992864bf253cfcc61b96014a373da36075cf15556bf5d3c321a7d1
SSDEEP

1536:yMN29OcZxVGGqcLfTsdmAy5bOw9giLxinrji6/74SPW/B+zOyY2K+:yFrx4WGyxOQ5xinrO6Ts/O/T

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1268	1468	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 1268	1468	f31d2ce12419de2f3c2a1601beaa8edd5cdde410229d5b7afeb2d0620c20f3ea.exe	28
PID 1468 wrote to memory of 1268	1468	f31d2ce12419de2f3c2a1601beaa8edd5cdde410229d5b7afeb2d0620c20f3ea.exe	28
PID 1468 wrote to memory of 1268	1468	f31d2ce12419de2f3c2a1601beaa8edd5cdde410229d5b7afeb2d0620c20f3ea.exe	28
PID 1468 wrote to memory of 1268	1468	f31d2ce12419de2f3c2a1601beaa8edd5cdde410229d5b7afeb2d0620c20f3ea.exe	28

C:\Users\Admin\AppData\Local\Temp\f31d2ce12419de2f3c2a1601beaa8edd5cdde410229d5b7afeb2d0620c20f3ea.exe
"C:\Users\Admin\AppData\Local\Temp\f31d2ce12419de2f3c2a1601beaa8edd5cdde410229d5b7afeb2d0620c20f3ea.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 36
  2⤵
  - Program crash
  PID:1268