cba7a696a64dc4e38ccc2aa32a0912557417eb2381f850679a33781f53c21d94

Analysis

max time kernel
244s
max time network
332s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 18:42

Target

cba7a696a64dc4e38ccc2aa32a0912557417eb2381f850679a33781f53c21d94.exe
Size

177KB
MD5

bdaabd716a755691102da0017d2f9a8d
SHA1

1135bc31463a2a065731f5a354de4a626a7ca550
SHA256

cba7a696a64dc4e38ccc2aa32a0912557417eb2381f850679a33781f53c21d94
SHA512

41726a1ab9642f9b8c932d3d9e09e25e662d85d48002000f8013b193037c6ab973038aee1c76893c696d898b5b8aa00f4a7fa9784d13113e5b690d34419c2a87
SSDEEP

3072:ezm6WNpIeNBxiJxouenDtxtTF+fZvSwGT++Mn5mz9/PsXVkQ:ezMKOrtDntTCZlGazg/CkQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
560	1888	WerFault.exe	27

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 560	1888	cba7a696a64dc4e38ccc2aa32a0912557417eb2381f850679a33781f53c21d94.exe	28
PID 1888 wrote to memory of 560	1888	cba7a696a64dc4e38ccc2aa32a0912557417eb2381f850679a33781f53c21d94.exe	28
PID 1888 wrote to memory of 560	1888	cba7a696a64dc4e38ccc2aa32a0912557417eb2381f850679a33781f53c21d94.exe	28
PID 1888 wrote to memory of 560	1888	cba7a696a64dc4e38ccc2aa32a0912557417eb2381f850679a33781f53c21d94.exe	28
PID 1888 wrote to memory of 560	1888	cba7a696a64dc4e38ccc2aa32a0912557417eb2381f850679a33781f53c21d94.exe	28
PID 1888 wrote to memory of 560	1888	cba7a696a64dc4e38ccc2aa32a0912557417eb2381f850679a33781f53c21d94.exe	28
PID 1888 wrote to memory of 560	1888	cba7a696a64dc4e38ccc2aa32a0912557417eb2381f850679a33781f53c21d94.exe	28

C:\Users\Admin\AppData\Local\Temp\cba7a696a64dc4e38ccc2aa32a0912557417eb2381f850679a33781f53c21d94.exe
"C:\Users\Admin\AppData\Local\Temp\cba7a696a64dc4e38ccc2aa32a0912557417eb2381f850679a33781f53c21d94.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 304
  2⤵
  - Program crash
  PID:560

memory/1888-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/1888-55-0x0000000000240000-0x0000000000291000-memory.dmp

Filesize
324KB

Download
memory/1888-56-0x0000000000240000-0x0000000000291000-memory.dmp

Filesize
324KB

Download