b1b684e024f05872f4b035114e4c12978807d050d92408269381712afb7e8404

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 15:02

Target

b1b684e024f05872f4b035114e4c12978807d050d92408269381712afb7e8404.exe
Size

16KB
MD5

a486bf5f7dc69621588d2a606ea57d3a
SHA1

c45317c682790df84d47877debdbbb4b6edc2a0e
SHA256

b1b684e024f05872f4b035114e4c12978807d050d92408269381712afb7e8404
SHA512

26eead829c51d4693a6df0d258f08a77bba80620995c4bbb1f4810fdb2bdde9eb6100efb9f7f50fe55be2dffcba9fe0a4e1286f4c038b9a69cdcf65b4d1687b5
SSDEEP

192:nQx6KMgpK3RFLTwAYsOKLkHGZ2vC+ANF+bT2jxD53tcZLnAEZ+fKXC5:SMgo3RFH3HLsuFRxD59ctAE4iC5

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1356 1308 WerFault.exe b1b684e024f05872f4b035114e4c12978807d050d92408269381712afb7e8404.exe

pid	pid_target	process	target process
1356	1308	WerFault.exe	b1b684e024f05872f4b035114e4c12978807d050d92408269381712afb7e8404.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b1b684e024f05872f4b035114e4c12978807d050d92408269381712afb7e8404.exe

description	pid	process	target process
PID 1308 wrote to memory of 1356	1308	b1b684e024f05872f4b035114e4c12978807d050d92408269381712afb7e8404.exe	WerFault.exe
PID 1308 wrote to memory of 1356	1308	b1b684e024f05872f4b035114e4c12978807d050d92408269381712afb7e8404.exe	WerFault.exe
PID 1308 wrote to memory of 1356	1308	b1b684e024f05872f4b035114e4c12978807d050d92408269381712afb7e8404.exe	WerFault.exe
PID 1308 wrote to memory of 1356	1308	b1b684e024f05872f4b035114e4c12978807d050d92408269381712afb7e8404.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\b1b684e024f05872f4b035114e4c12978807d050d92408269381712afb7e8404.exe
"C:\Users\Admin\AppData\Local\Temp\b1b684e024f05872f4b035114e4c12978807d050d92408269381712afb7e8404.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 88
2⤵
- Program crash
PID:1356