1c8ca323b302aeaa61400c247213fd9550f6e0e2bc2c31887c0c0c81ced19859

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 16:31

Target

1c8ca323b302aeaa61400c247213fd9550f6e0e2bc2c31887c0c0c81ced19859.exe
Size

65KB
MD5

6054cae211826f72e4b912608a95f937
SHA1

0e20a4c1a191d8c9a7080b31c094044ac9aa1711
SHA256

1c8ca323b302aeaa61400c247213fd9550f6e0e2bc2c31887c0c0c81ced19859
SHA512

1936437492e88e7d403470acba95e84f51fb6da193b18530acf5e7ba92cff3ef99c7a1e6583931a48e848d1764399acae89cb4e6eed7d73bc9f3d7e404979132
SSDEEP

1536:TiaiUk2Va0vwZzRXk1OJjV5OcI/j6/ju2YSfsnYXJKXX0JSkRxWMSC7jGN0f:TTdkMa8usOxTBI/j6/a3S0nsuiSiZjGG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1352	1392	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 1352	1392	1c8ca323b302aeaa61400c247213fd9550f6e0e2bc2c31887c0c0c81ced19859.exe	27
PID 1392 wrote to memory of 1352	1392	1c8ca323b302aeaa61400c247213fd9550f6e0e2bc2c31887c0c0c81ced19859.exe	27
PID 1392 wrote to memory of 1352	1392	1c8ca323b302aeaa61400c247213fd9550f6e0e2bc2c31887c0c0c81ced19859.exe	27
PID 1392 wrote to memory of 1352	1392	1c8ca323b302aeaa61400c247213fd9550f6e0e2bc2c31887c0c0c81ced19859.exe	27

C:\Users\Admin\AppData\Local\Temp\1c8ca323b302aeaa61400c247213fd9550f6e0e2bc2c31887c0c0c81ced19859.exe
"C:\Users\Admin\AppData\Local\Temp\1c8ca323b302aeaa61400c247213fd9550f6e0e2bc2c31887c0c0c81ced19859.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 164
  2⤵
  - Program crash
  PID:1352

memory/1392-54-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download