2bbf2ef4b53e38026013bdfb2f14d5d5d102a467b920418bc3863a9b520805ed

Analysis

max time kernel
36s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:24

Target

2bbf2ef4b53e38026013bdfb2f14d5d5d102a467b920418bc3863a9b520805ed.exe
Size

56KB
MD5

9e10f4c37889cd21fc603598ab7ccbbf
SHA1

cb3ec4fce6d592241130ee57fcb8b9f28bc2f929
SHA256

2bbf2ef4b53e38026013bdfb2f14d5d5d102a467b920418bc3863a9b520805ed
SHA512

3ba7ff36d2141e5a0103839405e0a6796fdeffeb7fcef960c29d156607a6b1e8cf215e166884d206a4182e544b38fec47b1da8322c4c0e0e0c6aee44d379a7e9
SSDEEP

1536:IwzDCYbAvSxvOddO46TiNe3gQyL2pT/n62Zq3tZ:B5j1C4n3gBL2pHEz

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1116 748 WerFault.exe 2bbf2ef4b53e38026013bdfb2f14d5d5d102a467b920418bc3863a9b520805ed.exe

pid	pid_target	process	target process
1116	748	WerFault.exe	2bbf2ef4b53e38026013bdfb2f14d5d5d102a467b920418bc3863a9b520805ed.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2bbf2ef4b53e38026013bdfb2f14d5d5d102a467b920418bc3863a9b520805ed.exe

description	pid	process	target process
PID 748 wrote to memory of 1116	748	2bbf2ef4b53e38026013bdfb2f14d5d5d102a467b920418bc3863a9b520805ed.exe	WerFault.exe
PID 748 wrote to memory of 1116	748	2bbf2ef4b53e38026013bdfb2f14d5d5d102a467b920418bc3863a9b520805ed.exe	WerFault.exe
PID 748 wrote to memory of 1116	748	2bbf2ef4b53e38026013bdfb2f14d5d5d102a467b920418bc3863a9b520805ed.exe	WerFault.exe
PID 748 wrote to memory of 1116	748	2bbf2ef4b53e38026013bdfb2f14d5d5d102a467b920418bc3863a9b520805ed.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2bbf2ef4b53e38026013bdfb2f14d5d5d102a467b920418bc3863a9b520805ed.exe
"C:\Users\Admin\AppData\Local\Temp\2bbf2ef4b53e38026013bdfb2f14d5d5d102a467b920418bc3863a9b520805ed.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 36
2⤵
- Program crash
PID:1116