1bd4abc21125d116ca1b721d180e1c36dd0bf7b78b69088a9b17c8445fdda085

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12/10/2022, 16:13

Target

file.exe
Size

359KB
MD5

a1c33d360b68460d9b42d30ba8eb0b66
SHA1

9a26e01b7330c77a2f15e39c0da564003841513a
SHA256

1bd4abc21125d116ca1b721d180e1c36dd0bf7b78b69088a9b17c8445fdda085
SHA512

47be7f5260bcaa860bfec3072d8a6db0c5c69cc9cc31f79c0f1fc44baa849bbb7f35c93066022f40f0c4694198105b33cbc218c38150dfbe02da4532b1099d71
SSDEEP

6144:qb3pDH9HadMdX6jN2iVydIgckBqNEp+1w6PAgLcMvhlOO85kMC+vh7HMyx5g6VO:qlGMQg+yuaZMT4chlKqEp7HM25K

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1916	1736	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1916	1736	file.exe	27
PID 1736 wrote to memory of 1916	1736	file.exe	27
PID 1736 wrote to memory of 1916	1736	file.exe	27
PID 1736 wrote to memory of 1916	1736	file.exe	27

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 100
  2⤵
  - Program crash
  PID:1916