cab656f8e0613933c28ac174ceaa688a096f26598e32b6a09a2b18512f82e923

Analysis

max time kernel
10s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 08:47

Target

cab656f8e0613933c28ac174ceaa688a096f26598e32b6a09a2b18512f82e923.exe
Size

8KB
MD5

9334c70ff650864926f9c25ae84522e7
SHA1

59d2fbc66513f922eedd378527dcf2fb0de52ca1
SHA256

cab656f8e0613933c28ac174ceaa688a096f26598e32b6a09a2b18512f82e923
SHA512

28db6fa31e42506e06fa6a0baaa1bbf74e9673320f2aa4be3fb60146dc90d5ebe528111ad9d88c92c1eafaf2b5cdbb9290ce1f2ed37653550e04b9883b9e7219
SSDEEP

192:zb6vePu5Ce8Cvp5NOMllXZw9REOEK6Np86:+Yu5eCvYMllXO9REOr6d

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1368	1800	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 1368	1800	cab656f8e0613933c28ac174ceaa688a096f26598e32b6a09a2b18512f82e923.exe	27
PID 1800 wrote to memory of 1368	1800	cab656f8e0613933c28ac174ceaa688a096f26598e32b6a09a2b18512f82e923.exe	27
PID 1800 wrote to memory of 1368	1800	cab656f8e0613933c28ac174ceaa688a096f26598e32b6a09a2b18512f82e923.exe	27
PID 1800 wrote to memory of 1368	1800	cab656f8e0613933c28ac174ceaa688a096f26598e32b6a09a2b18512f82e923.exe	27

C:\Users\Admin\AppData\Local\Temp\cab656f8e0613933c28ac174ceaa688a096f26598e32b6a09a2b18512f82e923.exe
"C:\Users\Admin\AppData\Local\Temp\cab656f8e0613933c28ac174ceaa688a096f26598e32b6a09a2b18512f82e923.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 148
  2⤵
  - Program crash
  PID:1368

memory/1800-55-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download