0c98d3c2ea3e12977181f3b22e9cbcfb831e7e31c509ee674ce384c0832cc245

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 16:51

Target

0c98d3c2ea3e12977181f3b22e9cbcfb831e7e31c509ee674ce384c0832cc245.exe
Size

471KB
MD5

a02c19490fbb1f2aaf954a8a51fe30b1
SHA1

f69654ced514a645725b97cf0f49af7b820de0f7
SHA256

0c98d3c2ea3e12977181f3b22e9cbcfb831e7e31c509ee674ce384c0832cc245
SHA512

5873ec0faa8514038f5e65c1dcc8fb8269d50f161aa8221c30764c67f68954cbadda184773e5469682003dda56c15813de5dee827f4390b8999dfe216f18b0b9
SSDEEP

12288:ZxZdWfDQYjCq/7ijMBmCjkVcNB08ZAWvDDQ:ZSQACq/uwmCgGNq8LDQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1152	984	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 1152	984	0c98d3c2ea3e12977181f3b22e9cbcfb831e7e31c509ee674ce384c0832cc245.exe	27
PID 984 wrote to memory of 1152	984	0c98d3c2ea3e12977181f3b22e9cbcfb831e7e31c509ee674ce384c0832cc245.exe	27
PID 984 wrote to memory of 1152	984	0c98d3c2ea3e12977181f3b22e9cbcfb831e7e31c509ee674ce384c0832cc245.exe	27
PID 984 wrote to memory of 1152	984	0c98d3c2ea3e12977181f3b22e9cbcfb831e7e31c509ee674ce384c0832cc245.exe	27

C:\Users\Admin\AppData\Local\Temp\0c98d3c2ea3e12977181f3b22e9cbcfb831e7e31c509ee674ce384c0832cc245.exe
"C:\Users\Admin\AppData\Local\Temp\0c98d3c2ea3e12977181f3b22e9cbcfb831e7e31c509ee674ce384c0832cc245.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 304
  2⤵
  - Program crash
  PID:1152

memory/984-54-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Filesize
8KB

Download
memory/984-56-0x0000000002050000-0x0000000002072000-memory.dmp

Filesize
136KB

Download