2c1f59412eb12ada026222414aec29b7aab3a78e076c5fc960ad444a9ad5d77a

Analysis

max time kernel
101s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 00:28

Target

2c1f59412eb12ada026222414aec29b7aab3a78e076c5fc960ad444a9ad5d77a.exe
Size

123KB
MD5

1a1021c12435a95501d49b7f139d3110
SHA1

374fc28ec0257588199fc386d7cd7a956d3cab16
SHA256

2c1f59412eb12ada026222414aec29b7aab3a78e076c5fc960ad444a9ad5d77a
SHA512

a0da24dec6959a8e34dcddedbeb8b9dffc57fdacdff1b61e400f3adfcaac22d74b9b48122951e112f6f1f0269a99f5d4a4f67a3ad6f10b8bcf6cc6e7d968be95
SSDEEP

768:Somd1TadYPnFDS5QOxOHH9qm83RC8/M769+IGDMu1Ezlhl9+UB698O8v+mY:SomDVPFDrKoeR9Y6+IGd1Ezlld6JK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1976	1996	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1976	1996	2c1f59412eb12ada026222414aec29b7aab3a78e076c5fc960ad444a9ad5d77a.exe	28
PID 1996 wrote to memory of 1976	1996	2c1f59412eb12ada026222414aec29b7aab3a78e076c5fc960ad444a9ad5d77a.exe	28
PID 1996 wrote to memory of 1976	1996	2c1f59412eb12ada026222414aec29b7aab3a78e076c5fc960ad444a9ad5d77a.exe	28
PID 1996 wrote to memory of 1976	1996	2c1f59412eb12ada026222414aec29b7aab3a78e076c5fc960ad444a9ad5d77a.exe	28

C:\Users\Admin\AppData\Local\Temp\2c1f59412eb12ada026222414aec29b7aab3a78e076c5fc960ad444a9ad5d77a.exe
"C:\Users\Admin\AppData\Local\Temp\2c1f59412eb12ada026222414aec29b7aab3a78e076c5fc960ad444a9ad5d77a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 88
  2⤵
  - Program crash
  PID:1976