ca3ed8ff0428cb77c9bb2493e6738c304a037e16dc5dbf1ce4646803e3530feb

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 13:53

Target

ca3ed8ff0428cb77c9bb2493e6738c304a037e16dc5dbf1ce4646803e3530feb.exe
Size

201KB
MD5

8cd6344d92ff4984049532b977710dc3
SHA1

4bd101d29e59ff548789efe719b7c89b138fb807
SHA256

ca3ed8ff0428cb77c9bb2493e6738c304a037e16dc5dbf1ce4646803e3530feb
SHA512

0811de0b07dc299f1dd8efc811c39a92e0d4d65d5d4a6b462b2d947f2e77adafef0b77608e1b1e41ad36a45dc04aaa860c1b5e1a68c91e5059fc852cb0e4c981
SSDEEP

3072:jY4Ag0FuA1CdtgFCTWp+vfPdZJWNBZcMYEdB5a:jvAOA1CdtyCKGHdqNfcMpdB8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
940	1652	WerFault.exe	27

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 1652	1208	ca3ed8ff0428cb77c9bb2493e6738c304a037e16dc5dbf1ce4646803e3530feb.exe	27
PID 1208 wrote to memory of 1652	1208	ca3ed8ff0428cb77c9bb2493e6738c304a037e16dc5dbf1ce4646803e3530feb.exe	27
PID 1208 wrote to memory of 1652	1208	ca3ed8ff0428cb77c9bb2493e6738c304a037e16dc5dbf1ce4646803e3530feb.exe	27
PID 1208 wrote to memory of 1652	1208	ca3ed8ff0428cb77c9bb2493e6738c304a037e16dc5dbf1ce4646803e3530feb.exe	27
PID 1208 wrote to memory of 1652	1208	ca3ed8ff0428cb77c9bb2493e6738c304a037e16dc5dbf1ce4646803e3530feb.exe	27
PID 1208 wrote to memory of 1652	1208	ca3ed8ff0428cb77c9bb2493e6738c304a037e16dc5dbf1ce4646803e3530feb.exe	27
PID 1208 wrote to memory of 1652	1208	ca3ed8ff0428cb77c9bb2493e6738c304a037e16dc5dbf1ce4646803e3530feb.exe	27
PID 1208 wrote to memory of 1652	1208	ca3ed8ff0428cb77c9bb2493e6738c304a037e16dc5dbf1ce4646803e3530feb.exe	27
PID 1208 wrote to memory of 1652	1208	ca3ed8ff0428cb77c9bb2493e6738c304a037e16dc5dbf1ce4646803e3530feb.exe	27
PID 1652 wrote to memory of 940	1652	explorer.exe	28
PID 1652 wrote to memory of 940	1652	explorer.exe	28
PID 1652 wrote to memory of 940	1652	explorer.exe	28
PID 1652 wrote to memory of 940	1652	explorer.exe	28

C:\Users\Admin\AppData\Local\Temp\ca3ed8ff0428cb77c9bb2493e6738c304a037e16dc5dbf1ce4646803e3530feb.exe
"C:\Users\Admin\AppData\Local\Temp\ca3ed8ff0428cb77c9bb2493e6738c304a037e16dc5dbf1ce4646803e3530feb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\SysWOW64\explorer.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 232
    3⤵
    - Program crash
    PID:940

memory/1208-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/1208-55-0x000000000ADB0000-0x000000000ADB3000-memory.dmp

Filesize
12KB

Download
memory/1208-59-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1652-56-0x0000000000090000-0x0000000000094000-memory.dmp

Filesize
16KB

Download
memory/1652-58-0x00000000000A0000-0x00000000000A3000-memory.dmp

Filesize
12KB

Download
memory/1652-63-0x00000000752A1000-0x00000000752A3000-memory.dmp

Filesize
8KB

Download