2c3da72404e3d2c5be01bf946aa9ee1d2aaf8c0d88a6804296e67079e4b1f8db

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 07:17

Target

2c3da72404e3d2c5be01bf946aa9ee1d2aaf8c0d88a6804296e67079e4b1f8db.exe
Size

291KB
MD5

069ab27c48780628acd4856f6e5decb0
SHA1

3486876ed6fff73acfc4bf4e747e21f46d1b5a7a
SHA256

2c3da72404e3d2c5be01bf946aa9ee1d2aaf8c0d88a6804296e67079e4b1f8db
SHA512

806ab11e6b3eb0b247286bf2dfbfa92063fb03cb69339df94cac8d8bfc5a69c1833c24ed77a59a01e9640580014d25041083573b68e82e37bf93fdda44330dee
SSDEEP

6144:WBDTSDW7QTvdm3ISa68kCAmslzCkc7xjxVW18Zj2iN:KTKvdmYS/8k/lTcZxI18Zj2iN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1196	1944	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1196	1944	2c3da72404e3d2c5be01bf946aa9ee1d2aaf8c0d88a6804296e67079e4b1f8db.exe	27
PID 1944 wrote to memory of 1196	1944	2c3da72404e3d2c5be01bf946aa9ee1d2aaf8c0d88a6804296e67079e4b1f8db.exe	27
PID 1944 wrote to memory of 1196	1944	2c3da72404e3d2c5be01bf946aa9ee1d2aaf8c0d88a6804296e67079e4b1f8db.exe	27
PID 1944 wrote to memory of 1196	1944	2c3da72404e3d2c5be01bf946aa9ee1d2aaf8c0d88a6804296e67079e4b1f8db.exe	27

C:\Users\Admin\AppData\Local\Temp\2c3da72404e3d2c5be01bf946aa9ee1d2aaf8c0d88a6804296e67079e4b1f8db.exe
"C:\Users\Admin\AppData\Local\Temp\2c3da72404e3d2c5be01bf946aa9ee1d2aaf8c0d88a6804296e67079e4b1f8db.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 160
  2⤵
  - Program crash
  PID:1196

memory/1944-54-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1944-56-0x0000000000930000-0x000000000097D000-memory.dmp

Filesize
308KB

Download