56666869cdfa2af955faea326f98d4ab003a7fc4d78003a028c1db8128ab3ed4

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
05/08/2023, 10:18

Target

56666869cdfa2af955faea326f98d4ab003a7fc4d78003a028c1db8128ab3ed4.exe
Size

56KB
MD5

f6ffbbea19155193be3286b407cb2e10
SHA1

ad8b804852fdb81a9cea41ced68e4fa0f8bd35d8
SHA256

56666869cdfa2af955faea326f98d4ab003a7fc4d78003a028c1db8128ab3ed4
SHA512

48ad885f196be043850127f2af3eb2cbe592ea2894d98816e74605c34be3ce546eacce98e7f37ff55341a0227ecffb84d3988b7f478e9b410aceae274b517a4b
SSDEEP

1536:Z0NbtHUqT0HKC18y/+AbU9UloZOy6dt1VHzLT:ZYbt0qTfCCy/p+7Oy6dt1VHz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2656	2528	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2656	2528	56666869cdfa2af955faea326f98d4ab003a7fc4d78003a028c1db8128ab3ed4.exe	29
PID 2528 wrote to memory of 2656	2528	56666869cdfa2af955faea326f98d4ab003a7fc4d78003a028c1db8128ab3ed4.exe	29
PID 2528 wrote to memory of 2656	2528	56666869cdfa2af955faea326f98d4ab003a7fc4d78003a028c1db8128ab3ed4.exe	29

C:\Users\Admin\AppData\Local\Temp\56666869cdfa2af955faea326f98d4ab003a7fc4d78003a028c1db8128ab3ed4.exe
"C:\Users\Admin\AppData\Local\Temp\56666869cdfa2af955faea326f98d4ab003a7fc4d78003a028c1db8128ab3ed4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2528 -s 1332
  2⤵
  - Program crash
  PID:2656