ff2628fd5358a920a8577f922035301312ba786a82047084138030477596ed96

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 06:44

Target

ff2628fd5358a920a8577f922035301312ba786a82047084138030477596ed96.exe
Size

607KB
MD5

2dea7220f0fd86e4faabfc9916047a90
SHA1

33a93336e0414f8b3bd545d4b9ffa369badb3b26
SHA256

ff2628fd5358a920a8577f922035301312ba786a82047084138030477596ed96
SHA512

d5744bc7f3dc2239ed5a3f5233fe1e371926f028179c4ac9449b2f5ebe45b18934fdc9b8cf0825f4b7a495ebfda24085313bdcb5826d80255d2ad920d65b6927
SSDEEP

12288:buYSlGyS5Z5Z5sy/y/yS5syS5sy81yS5sy/y/yS5Z5syg:PSlTeaa22802aaSg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1960	836	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 1960	836	ff2628fd5358a920a8577f922035301312ba786a82047084138030477596ed96.exe	28
PID 836 wrote to memory of 1960	836	ff2628fd5358a920a8577f922035301312ba786a82047084138030477596ed96.exe	28
PID 836 wrote to memory of 1960	836	ff2628fd5358a920a8577f922035301312ba786a82047084138030477596ed96.exe	28
PID 836 wrote to memory of 1960	836	ff2628fd5358a920a8577f922035301312ba786a82047084138030477596ed96.exe	28

C:\Users\Admin\AppData\Local\Temp\ff2628fd5358a920a8577f922035301312ba786a82047084138030477596ed96.exe
"C:\Users\Admin\AppData\Local\Temp\ff2628fd5358a920a8577f922035301312ba786a82047084138030477596ed96.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 92
  2⤵
  - Program crash
  PID:1960