3f42850f7f25450a324bbe97aa6e6f0840edac2c3d40ab76b6190e4c1c59796a

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 13:44

Target

3f42850f7f25450a324bbe97aa6e6f0840edac2c3d40ab76b6190e4c1c59796a.exe
Size

41KB
MD5

10c1bf03c45761546c20faa13ac5ab20
SHA1

ad192723ffd82ef18b77e9e795601735fbcfc814
SHA256

3f42850f7f25450a324bbe97aa6e6f0840edac2c3d40ab76b6190e4c1c59796a
SHA512

7630780290a252fa1dd3afebab1f5ac046ccf025a254512f20dc1d13c3e1cec458d2017b390210c0e7d1e189525806e926b7b90b07df3b6516cc234b83803ec0
SSDEEP

768:XCvqYQnsmgwTDZEe5/zr6UZ4p1G9vFLLV/1/5FSNNmRiOdrqtX/oW5/b8x:SvqYQnsmdGI/39xLFdSTmuZ/oA/Ix

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2016	1964	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2016	1964	3f42850f7f25450a324bbe97aa6e6f0840edac2c3d40ab76b6190e4c1c59796a.exe	29
PID 1964 wrote to memory of 2016	1964	3f42850f7f25450a324bbe97aa6e6f0840edac2c3d40ab76b6190e4c1c59796a.exe	29
PID 1964 wrote to memory of 2016	1964	3f42850f7f25450a324bbe97aa6e6f0840edac2c3d40ab76b6190e4c1c59796a.exe	29
PID 1964 wrote to memory of 2016	1964	3f42850f7f25450a324bbe97aa6e6f0840edac2c3d40ab76b6190e4c1c59796a.exe	29

C:\Users\Admin\AppData\Local\Temp\3f42850f7f25450a324bbe97aa6e6f0840edac2c3d40ab76b6190e4c1c59796a.exe
"C:\Users\Admin\AppData\Local\Temp\3f42850f7f25450a324bbe97aa6e6f0840edac2c3d40ab76b6190e4c1c59796a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 132
  2⤵
  - Program crash
  PID:2016