c2fdfcd741123817bda8f772ee2223e158427f02c14f25a0a47e2d7d0bc1bf54

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:21

Target

c2fdfcd741123817bda8f772ee2223e158427f02c14f25a0a47e2d7d0bc1bf54.exe
Size

91KB
MD5

c7c8778b714609572012b1a4890b2fee
SHA1

71c34c4b8d0dfc27caa232df59d2825cc6272145
SHA256

c2fdfcd741123817bda8f772ee2223e158427f02c14f25a0a47e2d7d0bc1bf54
SHA512

7a3155d999f773cf0447872138f836da83ed7f2d6e0c6febf7f67ee624bbda80cb0608a85c6e5355f3efb066a4c80cdbf5b19f1059d96131758ec0c7be38bb81
SSDEEP

1536:Z63xGtwJQaNYboRuP7VjESBZna3NYSneqvtc2zkLJlSUDIPOLIHzZR5FtvID:Z60t4QN8RyVtBqneIub7SExezt

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1480 1448 WerFault.exe c2fdfcd741123817bda8f772ee2223e158427f02c14f25a0a47e2d7d0bc1bf54.exe

pid	pid_target	process	target process
1480	1448	WerFault.exe	c2fdfcd741123817bda8f772ee2223e158427f02c14f25a0a47e2d7d0bc1bf54.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c2fdfcd741123817bda8f772ee2223e158427f02c14f25a0a47e2d7d0bc1bf54.exe

description	pid	process	target process
PID 1448 wrote to memory of 1480	1448	c2fdfcd741123817bda8f772ee2223e158427f02c14f25a0a47e2d7d0bc1bf54.exe	WerFault.exe
PID 1448 wrote to memory of 1480	1448	c2fdfcd741123817bda8f772ee2223e158427f02c14f25a0a47e2d7d0bc1bf54.exe	WerFault.exe
PID 1448 wrote to memory of 1480	1448	c2fdfcd741123817bda8f772ee2223e158427f02c14f25a0a47e2d7d0bc1bf54.exe	WerFault.exe
PID 1448 wrote to memory of 1480	1448	c2fdfcd741123817bda8f772ee2223e158427f02c14f25a0a47e2d7d0bc1bf54.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c2fdfcd741123817bda8f772ee2223e158427f02c14f25a0a47e2d7d0bc1bf54.exe
"C:\Users\Admin\AppData\Local\Temp\c2fdfcd741123817bda8f772ee2223e158427f02c14f25a0a47e2d7d0bc1bf54.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 36
2⤵
- Program crash
PID:1480

memory/1448-55-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1480-54-0x0000000000000000-mapping.dmp

Download