00c3d46fb579cac44bbbfd8de72593049c4001b6f6f5ebab8d3088e96b210114

Analysis

max time kernel
35s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 23:33

Target

00c3d46fb579cac44bbbfd8de72593049c4001b6f6f5ebab8d3088e96b210114.exe
Size

104KB
MD5

568ae146dbcdcb554e88ae635aec2145
SHA1

984e7dbfdbc1f75d75330169eac3368492dfc7dc
SHA256

00c3d46fb579cac44bbbfd8de72593049c4001b6f6f5ebab8d3088e96b210114
SHA512

0e8de03a8a9afa006037b69f582cc66af0acc2ee33c0fb263cbd329ea061a92ddaf285da9f81bcb852d714b1bdcd9ef5244b182839eb1f770ca254e7cf29fbca
SSDEEP

1536:s6sG41obA3/7d2FBNfyVVDzUyLZUK0buDqYQMLPFd7SqmbD:s6sGav7d2fqVDzPLZf0vULPF5Xi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1988	1980	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1988	1980	00c3d46fb579cac44bbbfd8de72593049c4001b6f6f5ebab8d3088e96b210114.exe	28
PID 1980 wrote to memory of 1988	1980	00c3d46fb579cac44bbbfd8de72593049c4001b6f6f5ebab8d3088e96b210114.exe	28
PID 1980 wrote to memory of 1988	1980	00c3d46fb579cac44bbbfd8de72593049c4001b6f6f5ebab8d3088e96b210114.exe	28
PID 1980 wrote to memory of 1988	1980	00c3d46fb579cac44bbbfd8de72593049c4001b6f6f5ebab8d3088e96b210114.exe	28

C:\Users\Admin\AppData\Local\Temp\00c3d46fb579cac44bbbfd8de72593049c4001b6f6f5ebab8d3088e96b210114.exe
"C:\Users\Admin\AppData\Local\Temp\00c3d46fb579cac44bbbfd8de72593049c4001b6f6f5ebab8d3088e96b210114.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 124
  2⤵
  - Program crash
  PID:1988

memory/1980-54-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download