c989d94357341d3dc0d2cfac7b05146865940fb404a52c79de70987ba1d4f2eb

Analysis

max time kernel
45s
max time network
125s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 01:21

Target

c989d94357341d3dc0d2cfac7b05146865940fb404a52c79de70987ba1d4f2eb.exe
Size

56KB
MD5

6fe3bae7b585f9661a695f3202b3d13f
SHA1

7ea237aa8fddfcbd0a4a3bdbd3868e17cf85c7a0
SHA256

c989d94357341d3dc0d2cfac7b05146865940fb404a52c79de70987ba1d4f2eb
SHA512

eb315a4ef9ee1622d79a864aa5ea41e4a0a45bc638cd61ef1112958a7c34dd61db6666fa4d27f67625407d020aea89cc5b031b9b148e6cf699a5eac089de61b9
SSDEEP

768:4pCYPF+w0QI9UvMec0f2sAMw04LpMFNSafPepK2hBSBgmszsVN7be7xmG6NFM8zs:4pC++i8vapPetBEGO7bGmb5hri9LUad7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1276	1340	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 1276	1340	c989d94357341d3dc0d2cfac7b05146865940fb404a52c79de70987ba1d4f2eb.exe	27
PID 1340 wrote to memory of 1276	1340	c989d94357341d3dc0d2cfac7b05146865940fb404a52c79de70987ba1d4f2eb.exe	27
PID 1340 wrote to memory of 1276	1340	c989d94357341d3dc0d2cfac7b05146865940fb404a52c79de70987ba1d4f2eb.exe	27
PID 1340 wrote to memory of 1276	1340	c989d94357341d3dc0d2cfac7b05146865940fb404a52c79de70987ba1d4f2eb.exe	27

C:\Users\Admin\AppData\Local\Temp\c989d94357341d3dc0d2cfac7b05146865940fb404a52c79de70987ba1d4f2eb.exe
"C:\Users\Admin\AppData\Local\Temp\c989d94357341d3dc0d2cfac7b05146865940fb404a52c79de70987ba1d4f2eb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 36
  2⤵
  - Program crash
  PID:1276