91ffd20d450b0428dd50a17cf5c5ee47e446fb98790e2d708d176ff931a2c4fe

Analysis

max time kernel
5s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 07:57

Target

91ffd20d450b0428dd50a17cf5c5ee47e446fb98790e2d708d176ff931a2c4fe.exe
Size

284KB
MD5

56f4d209110dfae4e44b2e8e95694d3e
SHA1

2ac7e212abcfe0460cc8e6c934d74a532c702253
SHA256

91ffd20d450b0428dd50a17cf5c5ee47e446fb98790e2d708d176ff931a2c4fe
SHA512

b1f0a88a12ec4e2cd3a98de571bef49a2d3072f756fe290956e6f8d5da4e930b47fa413b9f8788da9eeea31f76b8b749c633cedc2278c806cce7567e885922a9
SSDEEP

6144:fHVNrYfIZOLNk6OIP1hMn05olhliznF0qpan:9NrWIZ6XOIP1hM4oDUznF0E2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1380	1276	WerFault.exe	10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 1380	1276	91ffd20d450b0428dd50a17cf5c5ee47e446fb98790e2d708d176ff931a2c4fe.exe	28
PID 1276 wrote to memory of 1380	1276	91ffd20d450b0428dd50a17cf5c5ee47e446fb98790e2d708d176ff931a2c4fe.exe	28
PID 1276 wrote to memory of 1380	1276	91ffd20d450b0428dd50a17cf5c5ee47e446fb98790e2d708d176ff931a2c4fe.exe	28
PID 1276 wrote to memory of 1380	1276	91ffd20d450b0428dd50a17cf5c5ee47e446fb98790e2d708d176ff931a2c4fe.exe	28

C:\Users\Admin\AppData\Local\Temp\91ffd20d450b0428dd50a17cf5c5ee47e446fb98790e2d708d176ff931a2c4fe.exe
"C:\Users\Admin\AppData\Local\Temp\91ffd20d450b0428dd50a17cf5c5ee47e446fb98790e2d708d176ff931a2c4fe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 36
  2⤵
  - Program crash
  PID:1380