1c6f5b4756aae0c8d02c342d18b3b163b9840af831062048ae9aeb86a7b485d6

Analysis

max time kernel
32s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 02:43

Target

1c6f5b4756aae0c8d02c342d18b3b163b9840af831062048ae9aeb86a7b485d6.exe
Size

220KB
MD5

086472dc69b793dcb63093823d4934f3
SHA1

f50775d8be4a55949a179affcbf1500599f0616a
SHA256

1c6f5b4756aae0c8d02c342d18b3b163b9840af831062048ae9aeb86a7b485d6
SHA512

23f4ee5a58f518854073fb6568c04593bd55678b13ab572f779f7b5e4a4a7f8a7b17a3b581c685bda56aa1a26d403b6b6fe98e925d4fa27b4df3874cdf8f7281
SSDEEP

3072:cMwooltb5tpV+CSA1AAPoCpxW5ATBfUNjpS1svkTVC9FieYTTLprx/m3qT4S826X:cbtpvoCpcNQ1jQdi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
976	1756	WerFault.exe	20

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 976	1756	1c6f5b4756aae0c8d02c342d18b3b163b9840af831062048ae9aeb86a7b485d6.exe	28
PID 1756 wrote to memory of 976	1756	1c6f5b4756aae0c8d02c342d18b3b163b9840af831062048ae9aeb86a7b485d6.exe	28
PID 1756 wrote to memory of 976	1756	1c6f5b4756aae0c8d02c342d18b3b163b9840af831062048ae9aeb86a7b485d6.exe	28
PID 1756 wrote to memory of 976	1756	1c6f5b4756aae0c8d02c342d18b3b163b9840af831062048ae9aeb86a7b485d6.exe	28

C:\Users\Admin\AppData\Local\Temp\1c6f5b4756aae0c8d02c342d18b3b163b9840af831062048ae9aeb86a7b485d6.exe
"C:\Users\Admin\AppData\Local\Temp\1c6f5b4756aae0c8d02c342d18b3b163b9840af831062048ae9aeb86a7b485d6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 148
  2⤵
  - Program crash
  PID:976

memory/1756-55-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download