ff260f891046b12ff6e51bbb49db6f014e8b0353bdeec027d61ff9747d3ebf5d

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12/10/2022, 14:19

Target

ff260f891046b12ff6e51bbb49db6f014e8b0353bdeec027d61ff9747d3ebf5d.exe
Size

173KB
MD5

79dd577380a1765f12b76b6f38799290
SHA1

7c9b8ef6a437c612e16a6bd31db0d3f1d6e78a27
SHA256

ff260f891046b12ff6e51bbb49db6f014e8b0353bdeec027d61ff9747d3ebf5d
SHA512

d9955a5aea3b9c6abe58198c15bd00c622ef1821463e2f829c3120e887069bbce72a37070717c0a76701d99409cc81f1294700c8684dc8121b9ab66370dff005
SSDEEP

3072:1pzRNYuluupWyvbOijh7UAoaI52pySvl3nW0CWcscGF8ZHmt4qSWm:1ZRvupm9UX5WflXW5Wc88wGh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1628	1504	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1628	1504	ff260f891046b12ff6e51bbb49db6f014e8b0353bdeec027d61ff9747d3ebf5d.exe	27
PID 1504 wrote to memory of 1628	1504	ff260f891046b12ff6e51bbb49db6f014e8b0353bdeec027d61ff9747d3ebf5d.exe	27
PID 1504 wrote to memory of 1628	1504	ff260f891046b12ff6e51bbb49db6f014e8b0353bdeec027d61ff9747d3ebf5d.exe	27
PID 1504 wrote to memory of 1628	1504	ff260f891046b12ff6e51bbb49db6f014e8b0353bdeec027d61ff9747d3ebf5d.exe	27

C:\Users\Admin\AppData\Local\Temp\ff260f891046b12ff6e51bbb49db6f014e8b0353bdeec027d61ff9747d3ebf5d.exe
"C:\Users\Admin\AppData\Local\Temp\ff260f891046b12ff6e51bbb49db6f014e8b0353bdeec027d61ff9747d3ebf5d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 96
  2⤵
  - Program crash
  PID:1628