886294769e263123ddfa9971ab9748618c9c1269c6bd981739c14414e47b7aeb

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 21:52

Target

886294769e263123ddfa9971ab9748618c9c1269c6bd981739c14414e47b7aeb.exe
Size

48KB
MD5

de47812bb79f1ea24a6981eac50e511a
SHA1

2bb89443372af40a2553219fc516b81b1ad43385
SHA256

886294769e263123ddfa9971ab9748618c9c1269c6bd981739c14414e47b7aeb
SHA512

23ba6cf9e4eec28a1fe0df05660e0bdd9cf818b2185e1fd1428e94022d1070ce76d12ec3360b5e57390f6ab6b90d40cb479fa09911500209e9cda9c15bd1e0ca
SSDEEP

384:BC12g5V1ueAMUVnllI6RmkdWeGtt+BYE74NJk3DLHuvWcCDs4Fim/0Fbr:Bqv/1uefUVnliZ0YE74NJkTqvyt+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1364	1996	WerFault.exe	8

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1364	1996	886294769e263123ddfa9971ab9748618c9c1269c6bd981739c14414e47b7aeb.exe	28
PID 1996 wrote to memory of 1364	1996	886294769e263123ddfa9971ab9748618c9c1269c6bd981739c14414e47b7aeb.exe	28
PID 1996 wrote to memory of 1364	1996	886294769e263123ddfa9971ab9748618c9c1269c6bd981739c14414e47b7aeb.exe	28
PID 1996 wrote to memory of 1364	1996	886294769e263123ddfa9971ab9748618c9c1269c6bd981739c14414e47b7aeb.exe	28

C:\Users\Admin\AppData\Local\Temp\886294769e263123ddfa9971ab9748618c9c1269c6bd981739c14414e47b7aeb.exe
"C:\Users\Admin\AppData\Local\Temp\886294769e263123ddfa9971ab9748618c9c1269c6bd981739c14414e47b7aeb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 148
  2⤵
  - Program crash
  PID:1364