3c1ae38029ae606b9d0e024637c2758e8281a8c53591b0ad392193063fd58f3f

Analysis

max time kernel
39s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 23:09

Target

3c1ae38029ae606b9d0e024637c2758e8281a8c53591b0ad392193063fd58f3f.exe
Size

212KB
MD5

abb9d3faa74b7d91790c9e5b12adf625
SHA1

3393c95dd89c1024f66d1cba88968252b420bde6
SHA256

3c1ae38029ae606b9d0e024637c2758e8281a8c53591b0ad392193063fd58f3f
SHA512

18825f7b8f35defec29012903a18a0a85a2a370b1926c01bb069d6d5abb7c83f8a652f16d7b2d4358c31d07f3606bb18851e85670669101fddf8d1a553316f8e
SSDEEP

6144:5LOfykIWg/I+Omd6n1ENGQNGmt7pymjA2A:RG9xtOjA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1764	1664	WerFault.exe	27

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 1664	1352	3c1ae38029ae606b9d0e024637c2758e8281a8c53591b0ad392193063fd58f3f.exe	27
PID 1352 wrote to memory of 1664	1352	3c1ae38029ae606b9d0e024637c2758e8281a8c53591b0ad392193063fd58f3f.exe	27
PID 1352 wrote to memory of 1664	1352	3c1ae38029ae606b9d0e024637c2758e8281a8c53591b0ad392193063fd58f3f.exe	27
PID 1352 wrote to memory of 1664	1352	3c1ae38029ae606b9d0e024637c2758e8281a8c53591b0ad392193063fd58f3f.exe	27
PID 1352 wrote to memory of 1664	1352	3c1ae38029ae606b9d0e024637c2758e8281a8c53591b0ad392193063fd58f3f.exe	27
PID 1352 wrote to memory of 1664	1352	3c1ae38029ae606b9d0e024637c2758e8281a8c53591b0ad392193063fd58f3f.exe	27
PID 1352 wrote to memory of 1664	1352	3c1ae38029ae606b9d0e024637c2758e8281a8c53591b0ad392193063fd58f3f.exe	27
PID 1352 wrote to memory of 1664	1352	3c1ae38029ae606b9d0e024637c2758e8281a8c53591b0ad392193063fd58f3f.exe	27
PID 1352 wrote to memory of 1664	1352	3c1ae38029ae606b9d0e024637c2758e8281a8c53591b0ad392193063fd58f3f.exe	27
PID 1664 wrote to memory of 1764	1664	explorer.exe	28
PID 1664 wrote to memory of 1764	1664	explorer.exe	28
PID 1664 wrote to memory of 1764	1664	explorer.exe	28
PID 1664 wrote to memory of 1764	1664	explorer.exe	28

C:\Users\Admin\AppData\Local\Temp\3c1ae38029ae606b9d0e024637c2758e8281a8c53591b0ad392193063fd58f3f.exe
"C:\Users\Admin\AppData\Local\Temp\3c1ae38029ae606b9d0e024637c2758e8281a8c53591b0ad392193063fd58f3f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\SysWOW64\explorer.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 232
    3⤵
    - Program crash
    PID:1764

memory/1352-59-0x00000000002A0000-0x00000000002A4000-memory.dmp

Filesize
16KB

Download
memory/1352-61-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1664-54-0x0000000000090000-0x0000000000094000-memory.dmp

Filesize
16KB

Download
memory/1664-56-0x00000000000A0000-0x00000000000A3000-memory.dmp

Filesize
12KB

Download
memory/1664-60-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1664-62-0x00000000746E1000-0x00000000746E3000-memory.dmp

Filesize
8KB

Download