bc2eb43140aabea4d40cbc8a48df778fca536ddc25473cd6a7e558140933ed8e

Analysis

max time kernel
58s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 07:29

Target

bc2eb43140aabea4d40cbc8a48df778fca536ddc25473cd6a7e558140933ed8e.exe
Size

15KB
MD5

0caed21d2e8b0e7436f701c30bdeda9a
SHA1

47803eadfd0bf1161f96179672c1ba417e06daa0
SHA256

bc2eb43140aabea4d40cbc8a48df778fca536ddc25473cd6a7e558140933ed8e
SHA512

aeebaa886b4025974a9dde840b851e2009404cd4b94fad90c6d05889aa87db97891983174c7c15844225285db56ca41e94082d42df6d2c8e5f431863b0e13e0c
SSDEEP

384:u3bwC1XysBImEROcNTH1MRT6f+N0N2AiSp:e/1Xy2ERhFV4T6f+kp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
876	1152	WerFault.exe	18

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 876	1152	bc2eb43140aabea4d40cbc8a48df778fca536ddc25473cd6a7e558140933ed8e.exe	27
PID 1152 wrote to memory of 876	1152	bc2eb43140aabea4d40cbc8a48df778fca536ddc25473cd6a7e558140933ed8e.exe	27
PID 1152 wrote to memory of 876	1152	bc2eb43140aabea4d40cbc8a48df778fca536ddc25473cd6a7e558140933ed8e.exe	27
PID 1152 wrote to memory of 876	1152	bc2eb43140aabea4d40cbc8a48df778fca536ddc25473cd6a7e558140933ed8e.exe	27

C:\Users\Admin\AppData\Local\Temp\bc2eb43140aabea4d40cbc8a48df778fca536ddc25473cd6a7e558140933ed8e.exe
"C:\Users\Admin\AppData\Local\Temp\bc2eb43140aabea4d40cbc8a48df778fca536ddc25473cd6a7e558140933ed8e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 88
  2⤵
  - Program crash
  PID:876

memory/1152-55-0x0000000000220000-0x0000000000223000-memory.dmp

Filesize
12KB

Download