cbf9b019d617c4a7940947e8fae820da262cdbf5ec59eec175f485bd44ebe7f0

Analysis

max time kernel
38s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 19:31

Target

cbf9b019d617c4a7940947e8fae820da262cdbf5ec59eec175f485bd44ebe7f0.exe
Size

116KB
MD5

003c62321435e377e1dffc4c2bd952e0
SHA1

881208d0b955e9b74affa2c30568d4e604988df3
SHA256

cbf9b019d617c4a7940947e8fae820da262cdbf5ec59eec175f485bd44ebe7f0
SHA512

1978fb853a50da09d3d1b1ec4ea8dedc3cb79bb2b8c47dd2b7251137d7c49556ec9f07b3d8a4440efb906c4184f7717a7237acfaa42c2120738bba7ea575a044
SSDEEP

3072:911Jp5OzQcJ5nDQpA9ngLjhyxwG7PDPmOtdR6:913p5EQcJ5nDmAajhyxxbDPzD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1016	2020	WerFault.exe	18

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1016	2020	cbf9b019d617c4a7940947e8fae820da262cdbf5ec59eec175f485bd44ebe7f0.exe	27
PID 2020 wrote to memory of 1016	2020	cbf9b019d617c4a7940947e8fae820da262cdbf5ec59eec175f485bd44ebe7f0.exe	27
PID 2020 wrote to memory of 1016	2020	cbf9b019d617c4a7940947e8fae820da262cdbf5ec59eec175f485bd44ebe7f0.exe	27
PID 2020 wrote to memory of 1016	2020	cbf9b019d617c4a7940947e8fae820da262cdbf5ec59eec175f485bd44ebe7f0.exe	27

C:\Users\Admin\AppData\Local\Temp\cbf9b019d617c4a7940947e8fae820da262cdbf5ec59eec175f485bd44ebe7f0.exe
"C:\Users\Admin\AppData\Local\Temp\cbf9b019d617c4a7940947e8fae820da262cdbf5ec59eec175f485bd44ebe7f0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 160
  2⤵
  - Program crash
  PID:1016

memory/1016-54-0x0000000000000000-mapping.dmp

Download
memory/2020-55-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download