c0aec6626057c95de825567a2b4babaa7dbd9bcfcc1b24d93209fc4e4aa78fc8

Analysis

max time kernel
55s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:13

Target

c0aec6626057c95de825567a2b4babaa7dbd9bcfcc1b24d93209fc4e4aa78fc8.exe
Size

423KB
MD5

98eda106f5e82ad59d32da3d0d3ea16c
SHA1

99fe9d679cc7eff5053719ba807f8ea46ca809c6
SHA256

c0aec6626057c95de825567a2b4babaa7dbd9bcfcc1b24d93209fc4e4aa78fc8
SHA512

ec7ca74a518dfcf783e632cbb9ccb396fe2a6e65a2d87e95c62864f29ad2b357a285e029986a266ccd6d6341ed632df71eb4c19a42186937b6e3be8830cfd062
SSDEEP

6144:p65Sap7/EflP0+6w0Eick0SsRMw8wEb010BafFQdGVTMdJlFnYmTVcAom5WPav:A5Sa9A6R+Roo10AfFEGVIjYmTiLRCv

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1504 384 WerFault.exe c0aec6626057c95de825567a2b4babaa7dbd9bcfcc1b24d93209fc4e4aa78fc8.exe

pid	pid_target	process	target process
1504	384	WerFault.exe	c0aec6626057c95de825567a2b4babaa7dbd9bcfcc1b24d93209fc4e4aa78fc8.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c0aec6626057c95de825567a2b4babaa7dbd9bcfcc1b24d93209fc4e4aa78fc8.exe

description	pid	process	target process
PID 384 wrote to memory of 1504	384	c0aec6626057c95de825567a2b4babaa7dbd9bcfcc1b24d93209fc4e4aa78fc8.exe	WerFault.exe
PID 384 wrote to memory of 1504	384	c0aec6626057c95de825567a2b4babaa7dbd9bcfcc1b24d93209fc4e4aa78fc8.exe	WerFault.exe
PID 384 wrote to memory of 1504	384	c0aec6626057c95de825567a2b4babaa7dbd9bcfcc1b24d93209fc4e4aa78fc8.exe	WerFault.exe
PID 384 wrote to memory of 1504	384	c0aec6626057c95de825567a2b4babaa7dbd9bcfcc1b24d93209fc4e4aa78fc8.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c0aec6626057c95de825567a2b4babaa7dbd9bcfcc1b24d93209fc4e4aa78fc8.exe
"C:\Users\Admin\AppData\Local\Temp\c0aec6626057c95de825567a2b4babaa7dbd9bcfcc1b24d93209fc4e4aa78fc8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 384 -s 196
2⤵
- Program crash
PID:1504

memory/384-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/384-55-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1504-56-0x0000000000000000-mapping.dmp

Download