b20ec2bdfe468de9606dfa4276ade6bb95fad9b903b0ab1537c496e60ad8cdb4

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 23:38

Target

b20ec2bdfe468de9606dfa4276ade6bb95fad9b903b0ab1537c496e60ad8cdb4.exe
Size

525KB
MD5

15f3926bfc62adb777e785feb988e3f0
SHA1

ca297feaedbc08355000cd3c7f2e3b285f6df06f
SHA256

b20ec2bdfe468de9606dfa4276ade6bb95fad9b903b0ab1537c496e60ad8cdb4
SHA512

ec1bb9c9cdc5bc6f19c879050fdd392eafab47b5b5b6b92f4bf3c8a0cf09e025fc8f9317575b7d171f508b6c06945b1cd1fb12c580867f37cd4def4b6d630522
SSDEEP

12288:Si6fW93bu87hmkn+IHxIEAmAmhfWjkE4UQp:Sn6KihhBIfm/J

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1812	1600	WerFault.exe	13

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1812	1600	b20ec2bdfe468de9606dfa4276ade6bb95fad9b903b0ab1537c496e60ad8cdb4.exe	14
PID 1600 wrote to memory of 1812	1600	b20ec2bdfe468de9606dfa4276ade6bb95fad9b903b0ab1537c496e60ad8cdb4.exe	14
PID 1600 wrote to memory of 1812	1600	b20ec2bdfe468de9606dfa4276ade6bb95fad9b903b0ab1537c496e60ad8cdb4.exe	14
PID 1600 wrote to memory of 1812	1600	b20ec2bdfe468de9606dfa4276ade6bb95fad9b903b0ab1537c496e60ad8cdb4.exe	14

C:\Users\Admin\AppData\Local\Temp\b20ec2bdfe468de9606dfa4276ade6bb95fad9b903b0ab1537c496e60ad8cdb4.exe
"C:\Users\Admin\AppData\Local\Temp\b20ec2bdfe468de9606dfa4276ade6bb95fad9b903b0ab1537c496e60ad8cdb4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 36
  2⤵
  - Program crash
  PID:1812

memory/1600-55-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download