bc9f8369f8af845b5f776fbbae08716a28bc3bfca794307d23f5d6e1c916a256

Analysis

max time kernel
40s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
07/12/2022, 03:24

Target

bc9f8369f8af845b5f776fbbae08716a28bc3bfca794307d23f5d6e1c916a256.exe
Size

68KB
MD5

04f95cca645fcef7b4533f9c5c905216
SHA1

72a5fdd1b7a8e676084177ebc81627ad0b950a88
SHA256

bc9f8369f8af845b5f776fbbae08716a28bc3bfca794307d23f5d6e1c916a256
SHA512

9accc8aa071427a2b50b78ced977ecdf7a4a3d990f56bd6defab96dddcf48be1ec559eafc5e25f0c6ff737c484dc632b90d3b72c11ff0f181a67fa9b6184e8c0
SSDEEP

1536:TB+rXPrZLaubCl5gwqD4N7urtnqjdSZkSGODAeFJw9:orXT5auQ5JqDKiqB2k2seW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
596	1972	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 596	1972	bc9f8369f8af845b5f776fbbae08716a28bc3bfca794307d23f5d6e1c916a256.exe	28
PID 1972 wrote to memory of 596	1972	bc9f8369f8af845b5f776fbbae08716a28bc3bfca794307d23f5d6e1c916a256.exe	28
PID 1972 wrote to memory of 596	1972	bc9f8369f8af845b5f776fbbae08716a28bc3bfca794307d23f5d6e1c916a256.exe	28
PID 1972 wrote to memory of 596	1972	bc9f8369f8af845b5f776fbbae08716a28bc3bfca794307d23f5d6e1c916a256.exe	28

C:\Users\Admin\AppData\Local\Temp\bc9f8369f8af845b5f776fbbae08716a28bc3bfca794307d23f5d6e1c916a256.exe
"C:\Users\Admin\AppData\Local\Temp\bc9f8369f8af845b5f776fbbae08716a28bc3bfca794307d23f5d6e1c916a256.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 88
  2⤵
  - Program crash
  PID:596