f002baac9c55ec2edb4afb9f1236cf3271810998c8d80e013b3709180906de56

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11-04-2023 10:51

Target

f002baac9c55ec2edb4afb9f1236cf3271810998c8d80e013b3709180906de56.exe
Size

1.7MB
MD5

1cb2b40a62c15a692de95a5bffc5b3df
SHA1

401ee060970e5916d2973f7a8cc36589347ce7ba
SHA256

f002baac9c55ec2edb4afb9f1236cf3271810998c8d80e013b3709180906de56
SHA512

ec98b711cb77306a3c5f63d3f900acb8a6a3ebe7ef71111521e87b3b7f99c4a3104790deab3792a111c2c671a5cb912bf959365dd4fba2ece0ae80fc770ff4ce
SSDEEP

24576:cmza9kpDDDFcn14pkU1wFT4zwB34LMqriJoXO+/D1hIDSVXT5XWPoqt6Kya:ra9aFcnukU1wezmI9R/p/XT5XlY31

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1384	1644	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1384	1644	f002baac9c55ec2edb4afb9f1236cf3271810998c8d80e013b3709180906de56.exe	28
PID 1644 wrote to memory of 1384	1644	f002baac9c55ec2edb4afb9f1236cf3271810998c8d80e013b3709180906de56.exe	28
PID 1644 wrote to memory of 1384	1644	f002baac9c55ec2edb4afb9f1236cf3271810998c8d80e013b3709180906de56.exe	28

C:\Users\Admin\AppData\Local\Temp\f002baac9c55ec2edb4afb9f1236cf3271810998c8d80e013b3709180906de56.exe
"C:\Users\Admin\AppData\Local\Temp\f002baac9c55ec2edb4afb9f1236cf3271810998c8d80e013b3709180906de56.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1644 -s 144
  2⤵
  - Program crash
  PID:1384