ca1d69e000f91f1f1816450c6eebb9604781585554fc126d2556b7e9570550e6

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:17

Target

ca1d69e000f91f1f1816450c6eebb9604781585554fc126d2556b7e9570550e6.exe
Size

148KB
MD5

cff051c85551c35d47b8d523d581e03f
SHA1

00796b4c87708f575498abcd307950a034621451
SHA256

ca1d69e000f91f1f1816450c6eebb9604781585554fc126d2556b7e9570550e6
SHA512

cb7a1fe157ef41704d32c9269d0422a5313c422cdc12cd9e64ee65b8cf5fd2b5296698f2d410dcc8b2b7c39c90eaf2efca0dcac66af7fae691e3ac9ed73382e1
SSDEEP

1536:t+4YGr8dUofr+pHwXEa61XMZCeEn7AxBRAZqVAKzALppjVrs2ryrd1vUQuq6:t+4XifYHwo8soECAKzAdHs2qo

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1516 1708 WerFault.exe ca1d69e000f91f1f1816450c6eebb9604781585554fc126d2556b7e9570550e6.exe

pid	pid_target	process	target process
1516	1708	WerFault.exe	ca1d69e000f91f1f1816450c6eebb9604781585554fc126d2556b7e9570550e6.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ca1d69e000f91f1f1816450c6eebb9604781585554fc126d2556b7e9570550e6.exe

description	pid	process	target process
PID 1708 wrote to memory of 1516	1708	ca1d69e000f91f1f1816450c6eebb9604781585554fc126d2556b7e9570550e6.exe	WerFault.exe
PID 1708 wrote to memory of 1516	1708	ca1d69e000f91f1f1816450c6eebb9604781585554fc126d2556b7e9570550e6.exe	WerFault.exe
PID 1708 wrote to memory of 1516	1708	ca1d69e000f91f1f1816450c6eebb9604781585554fc126d2556b7e9570550e6.exe	WerFault.exe
PID 1708 wrote to memory of 1516	1708	ca1d69e000f91f1f1816450c6eebb9604781585554fc126d2556b7e9570550e6.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ca1d69e000f91f1f1816450c6eebb9604781585554fc126d2556b7e9570550e6.exe
"C:\Users\Admin\AppData\Local\Temp\ca1d69e000f91f1f1816450c6eebb9604781585554fc126d2556b7e9570550e6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 36
2⤵
- Program crash
PID:1516

memory/1516-54-0x0000000000000000-mapping.dmp

Download
memory/1708-55-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download