fc38b1f43a8d3299a96279295a2f5e9dfd80abf8e00ccea00da8e5bb81a89fe3

Analysis

max time kernel
19s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 03:38

Target

fc38b1f43a8d3299a96279295a2f5e9dfd80abf8e00ccea00da8e5bb81a89fe3.exe
Size

220KB
MD5

1dd13da842c9b6c4fb5d7b5f36e1f571
SHA1

f67cd0026a6ba4efdb54bf750ed75aa30d739d4f
SHA256

fc38b1f43a8d3299a96279295a2f5e9dfd80abf8e00ccea00da8e5bb81a89fe3
SHA512

0cb75fc471035183127085a75a40458e5f0eb1632ed8b5a034b3b65367dfd8921b7c1a6fbc77ee03d349cdca9666260d33d3dad5fa1bdd8f965984fd9b5cd3ec
SSDEEP

3072:lpFR3vd1typEtH4HGV5AAbpz4vCnLMkYGzuJi/K1y7O+aBzhdbvC5LV4Gf:93Kpg4HGVqAJnydJ8J7O+aBzhdbg4C

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1408	1460	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 1408	1460	fc38b1f43a8d3299a96279295a2f5e9dfd80abf8e00ccea00da8e5bb81a89fe3.exe	28
PID 1460 wrote to memory of 1408	1460	fc38b1f43a8d3299a96279295a2f5e9dfd80abf8e00ccea00da8e5bb81a89fe3.exe	28
PID 1460 wrote to memory of 1408	1460	fc38b1f43a8d3299a96279295a2f5e9dfd80abf8e00ccea00da8e5bb81a89fe3.exe	28
PID 1460 wrote to memory of 1408	1460	fc38b1f43a8d3299a96279295a2f5e9dfd80abf8e00ccea00da8e5bb81a89fe3.exe	28

C:\Users\Admin\AppData\Local\Temp\fc38b1f43a8d3299a96279295a2f5e9dfd80abf8e00ccea00da8e5bb81a89fe3.exe
"C:\Users\Admin\AppData\Local\Temp\fc38b1f43a8d3299a96279295a2f5e9dfd80abf8e00ccea00da8e5bb81a89fe3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 48
  2⤵
  - Program crash
  PID:1408