66cdb3176606768db4323fddc69f5fce4852655ea38dbe780e64576dd813ceda

Analysis

max time kernel
22s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 21:11

Target

66cdb3176606768db4323fddc69f5fce4852655ea38dbe780e64576dd813ceda.exe
Size

40KB
MD5

013f4d3b05a47e40b207b717af7e6bf2
SHA1

ec7f13cd0164d602783f3b14836e97b4385c02a7
SHA256

66cdb3176606768db4323fddc69f5fce4852655ea38dbe780e64576dd813ceda
SHA512

5bfc336d1d91d71d3163f057fd294d316ceea4ac24461d13d5cc3c39118cec1b506d685afb33b2cb075503d17aeeb5e7709a2bfe56af5ff15732a8d3125087ae
SSDEEP

384:j4f/IZEiSXi0K4wTboKxBfzstG7H7yc9RVm4f+sbPV1epULPEQfhoatwVdk:j4iE3qJTJhe0WYzljbPOpU7xfhosU2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1172	1224	WerFault.exe	18

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 1172	1224	66cdb3176606768db4323fddc69f5fce4852655ea38dbe780e64576dd813ceda.exe	28
PID 1224 wrote to memory of 1172	1224	66cdb3176606768db4323fddc69f5fce4852655ea38dbe780e64576dd813ceda.exe	28
PID 1224 wrote to memory of 1172	1224	66cdb3176606768db4323fddc69f5fce4852655ea38dbe780e64576dd813ceda.exe	28
PID 1224 wrote to memory of 1172	1224	66cdb3176606768db4323fddc69f5fce4852655ea38dbe780e64576dd813ceda.exe	28

C:\Users\Admin\AppData\Local\Temp\66cdb3176606768db4323fddc69f5fce4852655ea38dbe780e64576dd813ceda.exe
"C:\Users\Admin\AppData\Local\Temp\66cdb3176606768db4323fddc69f5fce4852655ea38dbe780e64576dd813ceda.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 36
  2⤵
  - Program crash
  PID:1172