cdc818d9984323815846a5d3f28c78c05141f116f9db15f5f61826890ee18e4f

Analysis

max time kernel
44s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
18-10-2022 16:12

Target

1216d95c615702dbcdec6733bc6053c7c6f00b0e6c9d8fb86e237fa991f1e1ed.exe
Size

9KB
MD5

a8e77e42012123d976f667fe8129e137
SHA1

6cc36fec69d74ab9bb2aef0d6dfb749a1d872890
SHA256

1216d95c615702dbcdec6733bc6053c7c6f00b0e6c9d8fb86e237fa991f1e1ed
SHA512

11c68baccb88c0c0726bad7d440a462c1b89c0f7cf3dc3365a7dd487a7b68d2af068e55e52ac648a3595668a238e20eb80a70390fcef075845428424228242f0
SSDEEP

96:3m2unjKp7Y5DkYoCYNiESNfWNsn8WEmO8qQuD1oCbyRTq8Q0iitFS32hWN3QU:3Kup7iDkYDxNeNejEmO8q7xlbuTXjL3

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1540 1708 WerFault.exe 1216d95c615702dbcdec6733bc6053c7c6f00b0e6c9d8fb86e237fa991f1e1ed.exe

pid	pid_target	process	target process
1540	1708	WerFault.exe	1216d95c615702dbcdec6733bc6053c7c6f00b0e6c9d8fb86e237fa991f1e1ed.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1216d95c615702dbcdec6733bc6053c7c6f00b0e6c9d8fb86e237fa991f1e1ed.exe

description	pid	process	target process
PID 1708 wrote to memory of 1540	1708	1216d95c615702dbcdec6733bc6053c7c6f00b0e6c9d8fb86e237fa991f1e1ed.exe	WerFault.exe
PID 1708 wrote to memory of 1540	1708	1216d95c615702dbcdec6733bc6053c7c6f00b0e6c9d8fb86e237fa991f1e1ed.exe	WerFault.exe
PID 1708 wrote to memory of 1540	1708	1216d95c615702dbcdec6733bc6053c7c6f00b0e6c9d8fb86e237fa991f1e1ed.exe	WerFault.exe
PID 1708 wrote to memory of 1540	1708	1216d95c615702dbcdec6733bc6053c7c6f00b0e6c9d8fb86e237fa991f1e1ed.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1216d95c615702dbcdec6733bc6053c7c6f00b0e6c9d8fb86e237fa991f1e1ed.exe
"C:\Users\Admin\AppData\Local\Temp\1216d95c615702dbcdec6733bc6053c7c6f00b0e6c9d8fb86e237fa991f1e1ed.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 284
  2⤵
  - Program crash
  PID:1540