3c5c97324f99b29332fcedc6cfa76c60cc6ccbfa66827f100ccca94323f50dfd

Analysis

max time kernel
37s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 01:53

Target

3c5c97324f99b29332fcedc6cfa76c60cc6ccbfa66827f100ccca94323f50dfd.exe
Size

194KB
MD5

938af3472753211f517e0f709ec18420
SHA1

9d762bd6ab37ab69062d971a9de71b07d99c5fff
SHA256

3c5c97324f99b29332fcedc6cfa76c60cc6ccbfa66827f100ccca94323f50dfd
SHA512

d62aa607dd6a5d77b4d7d1d85a86d98b91a5c38e6be9cf1504682d74ea4026dce07b641dbc450d1d8cccefde8b4954e49cffae6b3fe9244d37b0bb229893d19a
SSDEEP

3072:Dzwun1YbCdoJcBkmUWBMjM5ZXhvfTB1ds/N0/1SOrrkJEWOauwSq:HwSCbbcBaWBLtfrdfSOrgJHOXrq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1472	1504	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1472	1504	3c5c97324f99b29332fcedc6cfa76c60cc6ccbfa66827f100ccca94323f50dfd.exe	27
PID 1504 wrote to memory of 1472	1504	3c5c97324f99b29332fcedc6cfa76c60cc6ccbfa66827f100ccca94323f50dfd.exe	27
PID 1504 wrote to memory of 1472	1504	3c5c97324f99b29332fcedc6cfa76c60cc6ccbfa66827f100ccca94323f50dfd.exe	27
PID 1504 wrote to memory of 1472	1504	3c5c97324f99b29332fcedc6cfa76c60cc6ccbfa66827f100ccca94323f50dfd.exe	27

C:\Users\Admin\AppData\Local\Temp\3c5c97324f99b29332fcedc6cfa76c60cc6ccbfa66827f100ccca94323f50dfd.exe
"C:\Users\Admin\AppData\Local\Temp\3c5c97324f99b29332fcedc6cfa76c60cc6ccbfa66827f100ccca94323f50dfd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 168
  2⤵
  - Program crash
  PID:1472

memory/1504-54-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download