bee782ccce57796a71a449b5ea8176b459f77bd80a80b5195d650d6bd2a0164e

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-12-2022 02:02

Target

bee782ccce57796a71a449b5ea8176b459f77bd80a80b5195d650d6bd2a0164e.exe
Size

200KB
MD5

5efca2d0c3cbcf2e95ae266b07bc85e3
SHA1

e06794a1a0bfa9d275f07a0c89d347eca18df555
SHA256

bee782ccce57796a71a449b5ea8176b459f77bd80a80b5195d650d6bd2a0164e
SHA512

320579bc4d8dc80b93e85c9da0621a690772995b5198e807621a82d29f4c79769858b02a1f7611936ee50859164ae12d43064e73b630a24e152f5f216689aeae
SSDEEP

3072:Jy0tSNGD1UIL9ylST64NtR/TmwUyg/AyJ3auGO/XeUasJaXjVHUrIpcun6k:JyrGKEsST62Hh8Dx0njlk4cu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1688	1832	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 1688	1832	bee782ccce57796a71a449b5ea8176b459f77bd80a80b5195d650d6bd2a0164e.exe	28
PID 1832 wrote to memory of 1688	1832	bee782ccce57796a71a449b5ea8176b459f77bd80a80b5195d650d6bd2a0164e.exe	28
PID 1832 wrote to memory of 1688	1832	bee782ccce57796a71a449b5ea8176b459f77bd80a80b5195d650d6bd2a0164e.exe	28
PID 1832 wrote to memory of 1688	1832	bee782ccce57796a71a449b5ea8176b459f77bd80a80b5195d650d6bd2a0164e.exe	28

C:\Users\Admin\AppData\Local\Temp\bee782ccce57796a71a449b5ea8176b459f77bd80a80b5195d650d6bd2a0164e.exe
"C:\Users\Admin\AppData\Local\Temp\bee782ccce57796a71a449b5ea8176b459f77bd80a80b5195d650d6bd2a0164e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 172
  2⤵
  - Program crash
  PID:1688