f1cb42d07a1fbf16f653913c97e6f04d081011540f8a786604155070041ec5bd

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 11:48

Target

f1cb42d07a1fbf16f653913c97e6f04d081011540f8a786604155070041ec5bd.exe
Size

63KB
MD5

cb6b6fb9aedeadbaf71342d5efdcb8f5
SHA1

e68c3d0e29eb8f82f4c1e7fc2fa503600b62b58f
SHA256

f1cb42d07a1fbf16f653913c97e6f04d081011540f8a786604155070041ec5bd
SHA512

0410c9b0e9bdaacb68f7686cb2454fc1ca4d0820b71a9de3604e95e3bada10c5cba2fa148944c2b55885e48befaffac1b08010e601802d5f2577e22d5a792c95
SSDEEP

1536:8Jarcpz4fEiff71zDinnU61EBs4N7uCZ6a23kq4KeYJ5nL9j/:8IrcpzvW0rWBsM7zZN23WKea5L9j/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1188	1388	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1188	1388	f1cb42d07a1fbf16f653913c97e6f04d081011540f8a786604155070041ec5bd.exe	27
PID 1388 wrote to memory of 1188	1388	f1cb42d07a1fbf16f653913c97e6f04d081011540f8a786604155070041ec5bd.exe	27
PID 1388 wrote to memory of 1188	1388	f1cb42d07a1fbf16f653913c97e6f04d081011540f8a786604155070041ec5bd.exe	27
PID 1388 wrote to memory of 1188	1388	f1cb42d07a1fbf16f653913c97e6f04d081011540f8a786604155070041ec5bd.exe	27

C:\Users\Admin\AppData\Local\Temp\f1cb42d07a1fbf16f653913c97e6f04d081011540f8a786604155070041ec5bd.exe
"C:\Users\Admin\AppData\Local\Temp\f1cb42d07a1fbf16f653913c97e6f04d081011540f8a786604155070041ec5bd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 140
  2⤵
  - Program crash
  PID:1188

memory/1388-54-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download