1c3c49a2bedcb2d32718f511344ffd6bdced948aa79121e5871d37d654f2142b

Analysis

max time kernel
117s
max time network
131s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
12/11/2023, 23:45

Target

1c3c49a2bedcb2d32718f511344ffd6bdced948aa79121e5871d37d654f2142b.exe
Size

5KB
MD5

2ae81aa7e7c5e49addfd7f8f807721f9
SHA1

9f916dce2980d9ae008460641bd35978c4bec060
SHA256

1c3c49a2bedcb2d32718f511344ffd6bdced948aa79121e5871d37d654f2142b
SHA512

46436ba92c58536cbe45140e38b39fe46fa905eeb04058cb292dc35f6a8cbd87fd1a75b39a9f94d157d691a704dc9914da6e4790d15da875993ce3303b47d651
SSDEEP

48:SHlXWFPpT+dXVfzZh4yMGcKzMEkTaak4PAZivO2pB42pBdvMZL2R7thRuqSxp:YWLkFfNnOKYloIQ2pm2pbYSXxE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2716	2696	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2716	2696	1c3c49a2bedcb2d32718f511344ffd6bdced948aa79121e5871d37d654f2142b.exe	29
PID 2696 wrote to memory of 2716	2696	1c3c49a2bedcb2d32718f511344ffd6bdced948aa79121e5871d37d654f2142b.exe	29
PID 2696 wrote to memory of 2716	2696	1c3c49a2bedcb2d32718f511344ffd6bdced948aa79121e5871d37d654f2142b.exe	29
PID 2696 wrote to memory of 2716	2696	1c3c49a2bedcb2d32718f511344ffd6bdced948aa79121e5871d37d654f2142b.exe	29

C:\Users\Admin\AppData\Local\Temp\1c3c49a2bedcb2d32718f511344ffd6bdced948aa79121e5871d37d654f2142b.exe
"C:\Users\Admin\AppData\Local\Temp\1c3c49a2bedcb2d32718f511344ffd6bdced948aa79121e5871d37d654f2142b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 48
  2⤵
  - Program crash
  PID:2716