0fcf630bad50c85f4cb4e02665bbb774ec47e8bac9c1f27dde1ea877d77103ff

Analysis

max time kernel
13s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 13:32

Target

0fcf630bad50c85f4cb4e02665bbb774ec47e8bac9c1f27dde1ea877d77103ff.exe
Size

41KB
MD5

9295b0ea958b8faee74946be7eae9c30
SHA1

b958ea440b2c5aca93546ba610b37ce749612ba3
SHA256

0fcf630bad50c85f4cb4e02665bbb774ec47e8bac9c1f27dde1ea877d77103ff
SHA512

00d0e31f78ad48861116b6dc52350f6b887d67bde970cdbbb1809879121426343d27c897baec515fd6c73d8bbe6ef8427d384239ca186ac18e6b92b3ffce1b75
SSDEEP

384:5T6+y50ddIF8AuiNU2iDXmZNbQZ2AK7Ovj58ioqL+enZVhRYwLGYD6XqsCEefGG2:chsdIEzm7bQZdK7+m7M+eJCUMLCJfj2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1676	1588	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 1676	1588	0fcf630bad50c85f4cb4e02665bbb774ec47e8bac9c1f27dde1ea877d77103ff.exe	27
PID 1588 wrote to memory of 1676	1588	0fcf630bad50c85f4cb4e02665bbb774ec47e8bac9c1f27dde1ea877d77103ff.exe	27
PID 1588 wrote to memory of 1676	1588	0fcf630bad50c85f4cb4e02665bbb774ec47e8bac9c1f27dde1ea877d77103ff.exe	27
PID 1588 wrote to memory of 1676	1588	0fcf630bad50c85f4cb4e02665bbb774ec47e8bac9c1f27dde1ea877d77103ff.exe	27

C:\Users\Admin\AppData\Local\Temp\0fcf630bad50c85f4cb4e02665bbb774ec47e8bac9c1f27dde1ea877d77103ff.exe
"C:\Users\Admin\AppData\Local\Temp\0fcf630bad50c85f4cb4e02665bbb774ec47e8bac9c1f27dde1ea877d77103ff.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 36
  2⤵
  - Program crash
  PID:1676