c14b29963fc736bc59eb3254698c871cf8a16deddc7bb32e8b878b4223c6b2f6

Analysis

max time kernel
76s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:21

Target

c14b29963fc736bc59eb3254698c871cf8a16deddc7bb32e8b878b4223c6b2f6.exe
Size

56KB
MD5

fb990fcd04f7fbfaa62c47833946b4fd
SHA1

6e51c7ec0ac297d9d87251b6a9c8293c2f1b0e53
SHA256

c14b29963fc736bc59eb3254698c871cf8a16deddc7bb32e8b878b4223c6b2f6
SHA512

40d20f472556e4e72850f0f36d9bf27e45f328f36a8b47ca82577fa3032c5a536a020b1418f8b2f865fb8f14671821a10536a0ec15847470e516ab246654ef07
SSDEEP

1536:ok2nmDqC1Thrij26Ec9zo9BsU2qoYBdPdZ+XcU6:oxnmjTSx3zoqlaVUc1

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1308 940 WerFault.exe c14b29963fc736bc59eb3254698c871cf8a16deddc7bb32e8b878b4223c6b2f6.exe

pid	pid_target	process	target process
1308	940	WerFault.exe	c14b29963fc736bc59eb3254698c871cf8a16deddc7bb32e8b878b4223c6b2f6.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c14b29963fc736bc59eb3254698c871cf8a16deddc7bb32e8b878b4223c6b2f6.exe

description	pid	process	target process
PID 940 wrote to memory of 1308	940	c14b29963fc736bc59eb3254698c871cf8a16deddc7bb32e8b878b4223c6b2f6.exe	WerFault.exe
PID 940 wrote to memory of 1308	940	c14b29963fc736bc59eb3254698c871cf8a16deddc7bb32e8b878b4223c6b2f6.exe	WerFault.exe
PID 940 wrote to memory of 1308	940	c14b29963fc736bc59eb3254698c871cf8a16deddc7bb32e8b878b4223c6b2f6.exe	WerFault.exe
PID 940 wrote to memory of 1308	940	c14b29963fc736bc59eb3254698c871cf8a16deddc7bb32e8b878b4223c6b2f6.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c14b29963fc736bc59eb3254698c871cf8a16deddc7bb32e8b878b4223c6b2f6.exe
"C:\Users\Admin\AppData\Local\Temp\c14b29963fc736bc59eb3254698c871cf8a16deddc7bb32e8b878b4223c6b2f6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 36
2⤵
- Program crash
PID:1308