176298a1e4e0df42dd0d37ac9c55e1b801b65463fa503cce139dce5f30671bc8

Analysis

max time kernel
35s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 15:45

Target

176298a1e4e0df42dd0d37ac9c55e1b801b65463fa503cce139dce5f30671bc8.exe
Size

110KB
MD5

813d940c820f6607616a1e40bf13a7e0
SHA1

f6da3c417d81b310358116b55ef2e58d23bd3bbe
SHA256

176298a1e4e0df42dd0d37ac9c55e1b801b65463fa503cce139dce5f30671bc8
SHA512

45238b9a3ff534a39780d40d5400de6403804af24be1de32a04bb73d71a8d1bba0b1ee7c0727dcdbd4496cfedd38aab2f189856dff7b41c074af8d06bf35c4a6
SSDEEP

1536:fclfhsHvFnVS2DncI9BAKB550tu2LqjT7DQb6U5/sRl7WtibmF2jbxWGq6:fc4PFnVLDcpOP0tuKE1JytES2jbxWGq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1904	968	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 1904	968	176298a1e4e0df42dd0d37ac9c55e1b801b65463fa503cce139dce5f30671bc8.exe	28
PID 968 wrote to memory of 1904	968	176298a1e4e0df42dd0d37ac9c55e1b801b65463fa503cce139dce5f30671bc8.exe	28
PID 968 wrote to memory of 1904	968	176298a1e4e0df42dd0d37ac9c55e1b801b65463fa503cce139dce5f30671bc8.exe	28
PID 968 wrote to memory of 1904	968	176298a1e4e0df42dd0d37ac9c55e1b801b65463fa503cce139dce5f30671bc8.exe	28

C:\Users\Admin\AppData\Local\Temp\176298a1e4e0df42dd0d37ac9c55e1b801b65463fa503cce139dce5f30671bc8.exe
"C:\Users\Admin\AppData\Local\Temp\176298a1e4e0df42dd0d37ac9c55e1b801b65463fa503cce139dce5f30671bc8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 968 -s 92
  2⤵
  - Program crash
  PID:1904