be6fbc73602184c4350c15218f9ed6903617e67d4358038b33c4b4db7ee2be42

Analysis

max time kernel
39s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 07:14

Target

be6fbc73602184c4350c15218f9ed6903617e67d4358038b33c4b4db7ee2be42.exe
Size

266KB
MD5

1a8202f5475f80d6f2c74142d5f78360
SHA1

c267bef5573a08e6464fabf657c159c92e72b93d
SHA256

be6fbc73602184c4350c15218f9ed6903617e67d4358038b33c4b4db7ee2be42
SHA512

c47f0effba07d4d6cfd88c0cfea7a26b87b1f9a7b7816431501f5bbdc9b74b57944542d6b894674a85eae00afedfcfdc459fba5126a25ba66e63f6d4d55b4a25
SSDEEP

6144:ItC9CTIUTkKQQd1CS7O57KX7C2snVuukBl8j:ItCRUTkOESgmrynlS6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1548	1228	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 1548	1228	be6fbc73602184c4350c15218f9ed6903617e67d4358038b33c4b4db7ee2be42.exe	27
PID 1228 wrote to memory of 1548	1228	be6fbc73602184c4350c15218f9ed6903617e67d4358038b33c4b4db7ee2be42.exe	27
PID 1228 wrote to memory of 1548	1228	be6fbc73602184c4350c15218f9ed6903617e67d4358038b33c4b4db7ee2be42.exe	27
PID 1228 wrote to memory of 1548	1228	be6fbc73602184c4350c15218f9ed6903617e67d4358038b33c4b4db7ee2be42.exe	27

C:\Users\Admin\AppData\Local\Temp\be6fbc73602184c4350c15218f9ed6903617e67d4358038b33c4b4db7ee2be42.exe
"C:\Users\Admin\AppData\Local\Temp\be6fbc73602184c4350c15218f9ed6903617e67d4358038b33c4b4db7ee2be42.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 88
  2⤵
  - Program crash
  PID:1548