2b3c69223922f9c332b63ed6b12e7affb89d1f63047c647aca519ac654de1e68

Analysis

max time kernel
14s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:11

Target

2b3c69223922f9c332b63ed6b12e7affb89d1f63047c647aca519ac654de1e68.exe
Size

60KB
MD5

aa4a66a975adb53f10c96304d277bb50
SHA1

aba67be636260754e56a680b7f8b75f927fe3e68
SHA256

2b3c69223922f9c332b63ed6b12e7affb89d1f63047c647aca519ac654de1e68
SHA512

595174a9a4a249c85e8d0a3781f55a5636b5ee1002f0744cc01a6aca82c95a0753bf8c92a34ed7323804a3fbf902fc52eba96b082445c712d3d59161fea44e4a
SSDEEP

768:sZUXmQpqgwMcaBLbTam9C2Tr85KCEq2IZaS6R1ubyF5VWeTovQf6KncIApgsEW41:2shC2TAKCEyZax1ubCctvZz9y

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1552 1796 WerFault.exe 2b3c69223922f9c332b63ed6b12e7affb89d1f63047c647aca519ac654de1e68.exe

pid	pid_target	process	target process
1552	1796	WerFault.exe	2b3c69223922f9c332b63ed6b12e7affb89d1f63047c647aca519ac654de1e68.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2b3c69223922f9c332b63ed6b12e7affb89d1f63047c647aca519ac654de1e68.exe

description	pid	process	target process
PID 1796 wrote to memory of 1552	1796	2b3c69223922f9c332b63ed6b12e7affb89d1f63047c647aca519ac654de1e68.exe	WerFault.exe
PID 1796 wrote to memory of 1552	1796	2b3c69223922f9c332b63ed6b12e7affb89d1f63047c647aca519ac654de1e68.exe	WerFault.exe
PID 1796 wrote to memory of 1552	1796	2b3c69223922f9c332b63ed6b12e7affb89d1f63047c647aca519ac654de1e68.exe	WerFault.exe
PID 1796 wrote to memory of 1552	1796	2b3c69223922f9c332b63ed6b12e7affb89d1f63047c647aca519ac654de1e68.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2b3c69223922f9c332b63ed6b12e7affb89d1f63047c647aca519ac654de1e68.exe
"C:\Users\Admin\AppData\Local\Temp\2b3c69223922f9c332b63ed6b12e7affb89d1f63047c647aca519ac654de1e68.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 128
2⤵
- Program crash
PID:1552