0c76858841528c22ba5814ba14ddef1a26a7d3ec7712efcb122fab256ac72107

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 09:58

Target

0c76858841528c22ba5814ba14ddef1a26a7d3ec7712efcb122fab256ac72107.exe
Size

232KB
MD5

31768e0942b512ceb49262b17f1d0ad0
SHA1

e19552d219551135af2799edc8895588e429e95f
SHA256

0c76858841528c22ba5814ba14ddef1a26a7d3ec7712efcb122fab256ac72107
SHA512

695f396c716a1df13d43ce426f3ed5b9663c64b5759988aafe01974ba190a3fae7f60472bef20047734237cf5307d58fc6671c285e72b6a5039212dc047d4d52
SSDEEP

6144:iZkB8gb8OV7dV/CGLFkeEvhcPi6vN7xMRLfldR:Ygbddl5pYvhKDMRLfldR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2044	2016	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2044	2016	0c76858841528c22ba5814ba14ddef1a26a7d3ec7712efcb122fab256ac72107.exe	27
PID 2016 wrote to memory of 2044	2016	0c76858841528c22ba5814ba14ddef1a26a7d3ec7712efcb122fab256ac72107.exe	27
PID 2016 wrote to memory of 2044	2016	0c76858841528c22ba5814ba14ddef1a26a7d3ec7712efcb122fab256ac72107.exe	27
PID 2016 wrote to memory of 2044	2016	0c76858841528c22ba5814ba14ddef1a26a7d3ec7712efcb122fab256ac72107.exe	27

C:\Users\Admin\AppData\Local\Temp\0c76858841528c22ba5814ba14ddef1a26a7d3ec7712efcb122fab256ac72107.exe
"C:\Users\Admin\AppData\Local\Temp\0c76858841528c22ba5814ba14ddef1a26a7d3ec7712efcb122fab256ac72107.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 104
  2⤵
  - Program crash
  PID:2044

memory/2016-55-0x00000000002A0000-0x00000000002B2000-memory.dmp

Filesize
72KB

Download