c0a217ec204d3370cd5e58e06336ff636c92705f12995f05056f99228d92865b

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 10:29

Target

c0a217ec204d3370cd5e58e06336ff636c92705f12995f05056f99228d92865b.exe
Size

320KB
MD5

a266f6c7d1fe731ff2efd56fb222f900
SHA1

70627be00a4b4d9cbcd99a6d0a97caef4e7378a7
SHA256

c0a217ec204d3370cd5e58e06336ff636c92705f12995f05056f99228d92865b
SHA512

5cacaec8e94a7643978d49d81b9512e6059f1e223c97a6c3118a808904ff2794f7bcbb67720506c938bf7a4e7a551e9f019d66f77271b3cbac1a39600cc9e969
SSDEEP

6144:9W0oyH2RfS155ONNXBuWoJBO9OMbHLkAqF7Ief9UmM7/uT:9iw2EB0NxDIBuOFe7/uT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2012	1800	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 2012	1800	c0a217ec204d3370cd5e58e06336ff636c92705f12995f05056f99228d92865b.exe	28
PID 1800 wrote to memory of 2012	1800	c0a217ec204d3370cd5e58e06336ff636c92705f12995f05056f99228d92865b.exe	28
PID 1800 wrote to memory of 2012	1800	c0a217ec204d3370cd5e58e06336ff636c92705f12995f05056f99228d92865b.exe	28
PID 1800 wrote to memory of 2012	1800	c0a217ec204d3370cd5e58e06336ff636c92705f12995f05056f99228d92865b.exe	28

C:\Users\Admin\AppData\Local\Temp\c0a217ec204d3370cd5e58e06336ff636c92705f12995f05056f99228d92865b.exe
"C:\Users\Admin\AppData\Local\Temp\c0a217ec204d3370cd5e58e06336ff636c92705f12995f05056f99228d92865b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 36
  2⤵
  - Program crash
  PID:2012

memory/1800-55-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download