866cb7c4241d9f7ff2505d799f1a905c32a2ec9afde75ee0b83c5f541fb63131

Analysis

max time kernel
16s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 16:46

Target

866cb7c4241d9f7ff2505d799f1a905c32a2ec9afde75ee0b83c5f541fb63131.exe
Size

56KB
MD5

e6b54af55da354d1fa0b5e2ba89fff2f
SHA1

bd14b0793c053b046a4a9e79b855aa49793fbf8c
SHA256

866cb7c4241d9f7ff2505d799f1a905c32a2ec9afde75ee0b83c5f541fb63131
SHA512

c5da7d0c22aaaa73a8d681cbe95c5d4992e4bf35ec9650d46b1a6b9fbfa473816505548ed96f5a44988429dc8f46a4157950cd60b026c52f06f09b57fac0e3a8
SSDEEP

1536:DBbsAAEHFYu6obQyYvN/mEqCPn8kafbAmhxSDVpi9G+vPPy:DBbs51UQyYFFPqR8fMG+vC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
972	1952	WerFault.exe	20

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 972	1952	866cb7c4241d9f7ff2505d799f1a905c32a2ec9afde75ee0b83c5f541fb63131.exe	28
PID 1952 wrote to memory of 972	1952	866cb7c4241d9f7ff2505d799f1a905c32a2ec9afde75ee0b83c5f541fb63131.exe	28
PID 1952 wrote to memory of 972	1952	866cb7c4241d9f7ff2505d799f1a905c32a2ec9afde75ee0b83c5f541fb63131.exe	28
PID 1952 wrote to memory of 972	1952	866cb7c4241d9f7ff2505d799f1a905c32a2ec9afde75ee0b83c5f541fb63131.exe	28

C:\Users\Admin\AppData\Local\Temp\866cb7c4241d9f7ff2505d799f1a905c32a2ec9afde75ee0b83c5f541fb63131.exe
"C:\Users\Admin\AppData\Local\Temp\866cb7c4241d9f7ff2505d799f1a905c32a2ec9afde75ee0b83c5f541fb63131.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 36
  2⤵
  - Program crash
  PID:972