cb934c633b2c2ae5f747923c2e31caf09d4dd3aa1055c15530fd1f150f6df639

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:12

Target

cb934c633b2c2ae5f747923c2e31caf09d4dd3aa1055c15530fd1f150f6df639.exe
Size

108KB
MD5

4428fae35f39bc364845bebc59418113
SHA1

3e37b579777a41c724c37aeab883fa0af6b97fcd
SHA256

cb934c633b2c2ae5f747923c2e31caf09d4dd3aa1055c15530fd1f150f6df639
SHA512

f1008ec2362fb6060677fe5e72e0f4df0ae61f28510d36ecd29e8d230104271d851e383245d891364ec6ec23d9bbb0aeedafd93ae394b48c2294e4f3bfe6f410
SSDEEP

1536:cYdcBKiB6oQ7Lh5+sXmNt0ttJPXLq0zTrkC:9dOmoIeZt0XTzToC

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1344 1204 WerFault.exe cb934c633b2c2ae5f747923c2e31caf09d4dd3aa1055c15530fd1f150f6df639.exe

pid	pid_target	process	target process
1344	1204	WerFault.exe	cb934c633b2c2ae5f747923c2e31caf09d4dd3aa1055c15530fd1f150f6df639.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cb934c633b2c2ae5f747923c2e31caf09d4dd3aa1055c15530fd1f150f6df639.exe

description	pid	process	target process
PID 1204 wrote to memory of 1344	1204	cb934c633b2c2ae5f747923c2e31caf09d4dd3aa1055c15530fd1f150f6df639.exe	WerFault.exe
PID 1204 wrote to memory of 1344	1204	cb934c633b2c2ae5f747923c2e31caf09d4dd3aa1055c15530fd1f150f6df639.exe	WerFault.exe
PID 1204 wrote to memory of 1344	1204	cb934c633b2c2ae5f747923c2e31caf09d4dd3aa1055c15530fd1f150f6df639.exe	WerFault.exe
PID 1204 wrote to memory of 1344	1204	cb934c633b2c2ae5f747923c2e31caf09d4dd3aa1055c15530fd1f150f6df639.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\cb934c633b2c2ae5f747923c2e31caf09d4dd3aa1055c15530fd1f150f6df639.exe
"C:\Users\Admin\AppData\Local\Temp\cb934c633b2c2ae5f747923c2e31caf09d4dd3aa1055c15530fd1f150f6df639.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 180
2⤵
- Program crash
PID:1344

memory/1204-55-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1344-54-0x0000000000000000-mapping.dmp

Download