0991ead90e861558779d16d91ca93b579bcf5f5ffadc813951930a0336ddd917

Analysis

max time kernel
32s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 08:26

Target

0991ead90e861558779d16d91ca93b579bcf5f5ffadc813951930a0336ddd917.exe
Size

42KB
MD5

78100570f87b69bb0f3ca6b6908a5a60
SHA1

7994ba239a11c0fdec274af33ace0d1dcd99f511
SHA256

0991ead90e861558779d16d91ca93b579bcf5f5ffadc813951930a0336ddd917
SHA512

ad030f1fde2a759e77fdb7e46aab420c0a785d317f0219fdbf03f4ea8f3ce1a030d3783979222aaa570f7cbdc4f2e806b6807b95e15418e4807273c8ec9381cf
SSDEEP

384:06vLk4k1eiVTKYXnq40n8v10YEfucMqOjZc0GKfpYZ4hWvA9k74nsdk:tjkXwiVWYa4e8pEWcWksThfk7T2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1912	1020	WerFault.exe	20

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 1912	1020	0991ead90e861558779d16d91ca93b579bcf5f5ffadc813951930a0336ddd917.exe	27
PID 1020 wrote to memory of 1912	1020	0991ead90e861558779d16d91ca93b579bcf5f5ffadc813951930a0336ddd917.exe	27
PID 1020 wrote to memory of 1912	1020	0991ead90e861558779d16d91ca93b579bcf5f5ffadc813951930a0336ddd917.exe	27
PID 1020 wrote to memory of 1912	1020	0991ead90e861558779d16d91ca93b579bcf5f5ffadc813951930a0336ddd917.exe	27

C:\Users\Admin\AppData\Local\Temp\0991ead90e861558779d16d91ca93b579bcf5f5ffadc813951930a0336ddd917.exe
"C:\Users\Admin\AppData\Local\Temp\0991ead90e861558779d16d91ca93b579bcf5f5ffadc813951930a0336ddd917.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 36
  2⤵
  - Program crash
  PID:1912