b1c42a456ee4b85cde451048c158b6721e17939970d02b7b2fb048de98b65931

Analysis

max time kernel
43s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:23

Target

b1c42a456ee4b85cde451048c158b6721e17939970d02b7b2fb048de98b65931.exe
Size

460KB
MD5

5337e582f48119f2520ce8cc6bf0d360
SHA1

0405eb5087c3943eaee06ae4ff71917f288d38f0
SHA256

b1c42a456ee4b85cde451048c158b6721e17939970d02b7b2fb048de98b65931
SHA512

fc7fc127809c38bbf49833d31839c52bfd16089ac0dbc34121bac978c53ab8339d4b226883cf72733f2a0cf530747cf9dcca062f37f6b75a01803e01bf6f554a
SSDEEP

6144:HjalMr3NX+5Kbk6VhFKrsTmqrqyY0/1i51+GmKQcb6iufG/4J28sa/egMIbDPzD:Hj//bNVwXqouGPn6rfnn3

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

876 584 WerFault.exe b1c42a456ee4b85cde451048c158b6721e17939970d02b7b2fb048de98b65931.exe

pid	pid_target	process	target process
876	584	WerFault.exe	b1c42a456ee4b85cde451048c158b6721e17939970d02b7b2fb048de98b65931.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b1c42a456ee4b85cde451048c158b6721e17939970d02b7b2fb048de98b65931.exe

description	pid	process	target process
PID 584 wrote to memory of 876	584	b1c42a456ee4b85cde451048c158b6721e17939970d02b7b2fb048de98b65931.exe	WerFault.exe
PID 584 wrote to memory of 876	584	b1c42a456ee4b85cde451048c158b6721e17939970d02b7b2fb048de98b65931.exe	WerFault.exe
PID 584 wrote to memory of 876	584	b1c42a456ee4b85cde451048c158b6721e17939970d02b7b2fb048de98b65931.exe	WerFault.exe
PID 584 wrote to memory of 876	584	b1c42a456ee4b85cde451048c158b6721e17939970d02b7b2fb048de98b65931.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\b1c42a456ee4b85cde451048c158b6721e17939970d02b7b2fb048de98b65931.exe
"C:\Users\Admin\AppData\Local\Temp\b1c42a456ee4b85cde451048c158b6721e17939970d02b7b2fb048de98b65931.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 584 -s 124
2⤵
- Program crash
PID:876