bf19687371754182f74d513b140694bd185ba9a7c4909cd6e18fbc8837a8b58a

Analysis

max time kernel
3s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 12:30

Target

bf19687371754182f74d513b140694bd185ba9a7c4909cd6e18fbc8837a8b58a.exe
Size

101KB
MD5

a032e37aa0454f5e0c8b4a823ed837dc
SHA1

79f856ef6c923f6c295d0ed3c3506924e01994ac
SHA256

bf19687371754182f74d513b140694bd185ba9a7c4909cd6e18fbc8837a8b58a
SHA512

1f9a71e4b60a5a6aa7c89c3a1eaf3a5369a3372bd11ee9d2de5ad9abed1aa81cf9421df61e61d9e6354906683bd0681b7523ca4d713013534dca7e949264c473
SSDEEP

1536:aKrJwzLoUumsT0L1kTZJOdpJKqGNng0qasxuBcGWW+5SkXE6U:LrJGLoksayZJOdpJRWfXsicG4S9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
596	952	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 596	952	bf19687371754182f74d513b140694bd185ba9a7c4909cd6e18fbc8837a8b58a.exe	28
PID 952 wrote to memory of 596	952	bf19687371754182f74d513b140694bd185ba9a7c4909cd6e18fbc8837a8b58a.exe	28
PID 952 wrote to memory of 596	952	bf19687371754182f74d513b140694bd185ba9a7c4909cd6e18fbc8837a8b58a.exe	28
PID 952 wrote to memory of 596	952	bf19687371754182f74d513b140694bd185ba9a7c4909cd6e18fbc8837a8b58a.exe	28

C:\Users\Admin\AppData\Local\Temp\bf19687371754182f74d513b140694bd185ba9a7c4909cd6e18fbc8837a8b58a.exe
"C:\Users\Admin\AppData\Local\Temp\bf19687371754182f74d513b140694bd185ba9a7c4909cd6e18fbc8837a8b58a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 104
  2⤵
  - Program crash
  PID:596

memory/952-55-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download