cfb73b9811c5bc90a699a158e0adfa2267ba24b5a5487a5ef610376489e7ad79

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
21/10/2022, 00:48

Target

cfb73b9811c5bc90a699a158e0adfa2267ba24b5a5487a5ef610376489e7ad79.exe
Size

1.1MB
MD5

6f16379e402982eed164c5625791c4f2
SHA1

23c23602b2e0af29613dfbd395d33b353867c3b0
SHA256

cfb73b9811c5bc90a699a158e0adfa2267ba24b5a5487a5ef610376489e7ad79
SHA512

c30b53491ca277b1661aee1931123080475f090d626dcec3a0d3d0df16e227ba5b244f5e896145e64293837246f8395913fe1b78fcc76eaf2afcacc05fe46e04
SSDEEP

6144:78kydjEikt09cOd0LnD6v/dLeDnPt1oP/N0D683UtcQxw+hA3SgQEKmTSsQLH5A+:/4nJd0Ln0LeTt1S63J5SsPd8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
956	1168	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 956	1168	cfb73b9811c5bc90a699a158e0adfa2267ba24b5a5487a5ef610376489e7ad79.exe	27
PID 1168 wrote to memory of 956	1168	cfb73b9811c5bc90a699a158e0adfa2267ba24b5a5487a5ef610376489e7ad79.exe	27
PID 1168 wrote to memory of 956	1168	cfb73b9811c5bc90a699a158e0adfa2267ba24b5a5487a5ef610376489e7ad79.exe	27
PID 1168 wrote to memory of 956	1168	cfb73b9811c5bc90a699a158e0adfa2267ba24b5a5487a5ef610376489e7ad79.exe	27

C:\Users\Admin\AppData\Local\Temp\cfb73b9811c5bc90a699a158e0adfa2267ba24b5a5487a5ef610376489e7ad79.exe
"C:\Users\Admin\AppData\Local\Temp\cfb73b9811c5bc90a699a158e0adfa2267ba24b5a5487a5ef610376489e7ad79.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 232
  2⤵
  - Program crash
  PID:956

memory/1168-54-0x00000000760E1000-0x00000000760E3000-memory.dmp

Filesize
8KB

Download
memory/1168-56-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download