dc6be846d14946fb48f1cf4eef99b987cc7f6ba520422b4e130976d191727909

Analysis

max time kernel
7s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 13:32

Target

dc6be846d14946fb48f1cf4eef99b987cc7f6ba520422b4e130976d191727909.exe
Size

320KB
MD5

04d1ea8a71a3b58a9fe15d472fa7a461
SHA1

a86e1edea2edd21edb61516d7f22d5e34de3441d
SHA256

dc6be846d14946fb48f1cf4eef99b987cc7f6ba520422b4e130976d191727909
SHA512

414648698df989d20b61f2d7d815ee2c5bf4e840f7001d6a287f7f344de394765056b233d0daac0a5e61a441820fd975dde25eefec2990815352cae8853ee82a
SSDEEP

3072:+47eOwd5rWgkb4MsekXvKflbWYefttWhthFLbwbN5bA4nQKWn51BuAK9sI6Ahqse:+47yDBvevbc1tqbwZtuhATIWbt0cRq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
536	1780	WerFault.exe	18

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 536	1780	dc6be846d14946fb48f1cf4eef99b987cc7f6ba520422b4e130976d191727909.exe	28
PID 1780 wrote to memory of 536	1780	dc6be846d14946fb48f1cf4eef99b987cc7f6ba520422b4e130976d191727909.exe	28
PID 1780 wrote to memory of 536	1780	dc6be846d14946fb48f1cf4eef99b987cc7f6ba520422b4e130976d191727909.exe	28
PID 1780 wrote to memory of 536	1780	dc6be846d14946fb48f1cf4eef99b987cc7f6ba520422b4e130976d191727909.exe	28

C:\Users\Admin\AppData\Local\Temp\dc6be846d14946fb48f1cf4eef99b987cc7f6ba520422b4e130976d191727909.exe
"C:\Users\Admin\AppData\Local\Temp\dc6be846d14946fb48f1cf4eef99b987cc7f6ba520422b4e130976d191727909.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 156
  2⤵
  - Program crash
  PID:536