c0057f77ef65bb8cb6af8fbfaab8bc3792be446b7250b9fb7cb843618c94ecd6

Analysis

max time kernel
29s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 15:32

Target

c0057f77ef65bb8cb6af8fbfaab8bc3792be446b7250b9fb7cb843618c94ecd6.exe
Size

99KB
MD5

c6065683ac691c46ed6f2b2c99b5426a
SHA1

b71c177ceddf0be7b3a2acc3366a186e3c7ef294
SHA256

c0057f77ef65bb8cb6af8fbfaab8bc3792be446b7250b9fb7cb843618c94ecd6
SHA512

3c0e45656bc4121e27afd7a618fb5ec36c6c57e2a6b89ea3f5dfaa7490683262004a6e85501b989a6d830074e943b84c2341f6f32f624ac4ae9341e8e8fe0557
SSDEEP

3072:q2hzgKSXgsmyL9egmSKSmeI3uFZS6p051Fwn:q40Kogsmy5Vweo+051FW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1600	1548	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 1600	1548	c0057f77ef65bb8cb6af8fbfaab8bc3792be446b7250b9fb7cb843618c94ecd6.exe	28
PID 1548 wrote to memory of 1600	1548	c0057f77ef65bb8cb6af8fbfaab8bc3792be446b7250b9fb7cb843618c94ecd6.exe	28
PID 1548 wrote to memory of 1600	1548	c0057f77ef65bb8cb6af8fbfaab8bc3792be446b7250b9fb7cb843618c94ecd6.exe	28
PID 1548 wrote to memory of 1600	1548	c0057f77ef65bb8cb6af8fbfaab8bc3792be446b7250b9fb7cb843618c94ecd6.exe	28

C:\Users\Admin\AppData\Local\Temp\c0057f77ef65bb8cb6af8fbfaab8bc3792be446b7250b9fb7cb843618c94ecd6.exe
"C:\Users\Admin\AppData\Local\Temp\c0057f77ef65bb8cb6af8fbfaab8bc3792be446b7250b9fb7cb843618c94ecd6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 92
  2⤵
  - Program crash
  PID:1600