cbe358e9d0b5d244b1da9126c7fbd72b4868ec81fb3067f2033901b334eb5545

Analysis

max time kernel
130s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:18

Target

cbe358e9d0b5d244b1da9126c7fbd72b4868ec81fb3067f2033901b334eb5545.exe
Size

151KB
MD5

43c8d2cf99ff4352cb24e10ad9d62f35
SHA1

4cce599b9b83dd9fe6daf79e506a9d8b35837b6c
SHA256

cbe358e9d0b5d244b1da9126c7fbd72b4868ec81fb3067f2033901b334eb5545
SHA512

cb1ae9dd27cfbd55d5228a7d2731a9559012ff68a2c8e04fa14fda1e93db85a9add103d86712d1049b2eaec7baed4be5d709a10d3dbae5cefd32e9e5a6f02a66
SSDEEP

3072:O3McZrbfPZaIrZ6lyQKFUtDcdDXMlSsksNlxAzcqcB4bS9fogFnv:OjpnZaIFRhdD5sNNleIqcoefvN

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1172 1356 WerFault.exe cbe358e9d0b5d244b1da9126c7fbd72b4868ec81fb3067f2033901b334eb5545.exe

pid	pid_target	process	target process
1172	1356	WerFault.exe	cbe358e9d0b5d244b1da9126c7fbd72b4868ec81fb3067f2033901b334eb5545.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cbe358e9d0b5d244b1da9126c7fbd72b4868ec81fb3067f2033901b334eb5545.exe

description	pid	process	target process
PID 1356 wrote to memory of 1172	1356	cbe358e9d0b5d244b1da9126c7fbd72b4868ec81fb3067f2033901b334eb5545.exe	WerFault.exe
PID 1356 wrote to memory of 1172	1356	cbe358e9d0b5d244b1da9126c7fbd72b4868ec81fb3067f2033901b334eb5545.exe	WerFault.exe
PID 1356 wrote to memory of 1172	1356	cbe358e9d0b5d244b1da9126c7fbd72b4868ec81fb3067f2033901b334eb5545.exe	WerFault.exe
PID 1356 wrote to memory of 1172	1356	cbe358e9d0b5d244b1da9126c7fbd72b4868ec81fb3067f2033901b334eb5545.exe	WerFault.exe
PID 1356 wrote to memory of 1172	1356	cbe358e9d0b5d244b1da9126c7fbd72b4868ec81fb3067f2033901b334eb5545.exe	WerFault.exe
PID 1356 wrote to memory of 1172	1356	cbe358e9d0b5d244b1da9126c7fbd72b4868ec81fb3067f2033901b334eb5545.exe	WerFault.exe
PID 1356 wrote to memory of 1172	1356	cbe358e9d0b5d244b1da9126c7fbd72b4868ec81fb3067f2033901b334eb5545.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\cbe358e9d0b5d244b1da9126c7fbd72b4868ec81fb3067f2033901b334eb5545.exe
"C:\Users\Admin\AppData\Local\Temp\cbe358e9d0b5d244b1da9126c7fbd72b4868ec81fb3067f2033901b334eb5545.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 256
2⤵
- Program crash
PID:1172

memory/1172-56-0x0000000000000000-mapping.dmp

Download
memory/1356-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1356-55-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download
memory/1356-57-0x0000000000230000-0x0000000000259000-memory.dmp

Filesize
164KB

Download
memory/1356-58-0x0000000000230000-0x0000000000259000-memory.dmp

Filesize
164KB

Download
memory/1356-59-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download