af7c2eb971e345917695e4fddea3dc556667821936dd3c27c09584085cdc90d6

Analysis

max time kernel
40s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/11/2022, 23:18

Target

af7c2eb971e345917695e4fddea3dc556667821936dd3c27c09584085cdc90d6.exe
Size

41KB
MD5

492b372fe9018568da7a2f5b51673e82
SHA1

36e5f84d194e330962706f4e73569ebaf9c16a82
SHA256

af7c2eb971e345917695e4fddea3dc556667821936dd3c27c09584085cdc90d6
SHA512

d16e24e6cf6e39744820b3fb86019d52410e0d0db29b38668da2143fe98214ab430f4d7836ac609f1bf961aafdd5747b5106cdec417796957c7edbc77c39a6ee
SSDEEP

768:Eg2i5UyWOCbAhArSoVx/v7s+XgpzEmtXQJyE83Pa:F2i5Uyp8GIVx7vXgKmada

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1508	1484	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 1508	1484	af7c2eb971e345917695e4fddea3dc556667821936dd3c27c09584085cdc90d6.exe	28
PID 1484 wrote to memory of 1508	1484	af7c2eb971e345917695e4fddea3dc556667821936dd3c27c09584085cdc90d6.exe	28
PID 1484 wrote to memory of 1508	1484	af7c2eb971e345917695e4fddea3dc556667821936dd3c27c09584085cdc90d6.exe	28
PID 1484 wrote to memory of 1508	1484	af7c2eb971e345917695e4fddea3dc556667821936dd3c27c09584085cdc90d6.exe	28

C:\Users\Admin\AppData\Local\Temp\af7c2eb971e345917695e4fddea3dc556667821936dd3c27c09584085cdc90d6.exe
"C:\Users\Admin\AppData\Local\Temp\af7c2eb971e345917695e4fddea3dc556667821936dd3c27c09584085cdc90d6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 88
  2⤵
  - Program crash
  PID:1508