cffee2efb9af5c862bb95bcac8c7b516861d0295c510900425a6b5ddfe18ef58

Analysis

max time kernel
39s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 21:56

Target

cffee2efb9af5c862bb95bcac8c7b516861d0295c510900425a6b5ddfe18ef58.exe
Size

119KB
MD5

240f1d9360db858990c79c03e94925dc
SHA1

30dbbec9b83e04d011dd1c31f005a827e6113c1c
SHA256

cffee2efb9af5c862bb95bcac8c7b516861d0295c510900425a6b5ddfe18ef58
SHA512

0d8f1ee7ab6d36f2b31dec41142ad11ebe637c58a4951329243b681c376ab7184f0f86a83943af07d86ad8600e0aecf07aa0ebfcde275d8d81744a5dcc544c76
SSDEEP

1536:Q2222iMq1QAxBa90BHz0oHTGDMdlea8vVRLwswVDpRkXJhoyVrpjVrs2ryrd1vU1:rP7nBTWYOaxzRk5hfHs2qxnC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1180	596	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 596 wrote to memory of 1180	596	cffee2efb9af5c862bb95bcac8c7b516861d0295c510900425a6b5ddfe18ef58.exe	28
PID 596 wrote to memory of 1180	596	cffee2efb9af5c862bb95bcac8c7b516861d0295c510900425a6b5ddfe18ef58.exe	28
PID 596 wrote to memory of 1180	596	cffee2efb9af5c862bb95bcac8c7b516861d0295c510900425a6b5ddfe18ef58.exe	28
PID 596 wrote to memory of 1180	596	cffee2efb9af5c862bb95bcac8c7b516861d0295c510900425a6b5ddfe18ef58.exe	28

C:\Users\Admin\AppData\Local\Temp\cffee2efb9af5c862bb95bcac8c7b516861d0295c510900425a6b5ddfe18ef58.exe
"C:\Users\Admin\AppData\Local\Temp\cffee2efb9af5c862bb95bcac8c7b516861d0295c510900425a6b5ddfe18ef58.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 596 -s 36
  2⤵
  - Program crash
  PID:1180

memory/596-55-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download