ad2cd61d00a0f93f2e2afe42aae8980d16b83ec356b92c6d1cc17a5b4274004b

Analysis

max time kernel
8s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 04:24

Target

ad2cd61d00a0f93f2e2afe42aae8980d16b83ec356b92c6d1cc17a5b4274004b.exe
Size

75KB
MD5

bd607751ae23a03fb174ee1f50a1a9de
SHA1

c75ae7d0404328bd242787e588ae41c82581f5ec
SHA256

ad2cd61d00a0f93f2e2afe42aae8980d16b83ec356b92c6d1cc17a5b4274004b
SHA512

6a88282e321cb1f2d44b729a8dd216b0f3ddfcf8117fb6d987fd624c71ce794e90f229386cd73b7b68b6136e2d02e06f45ea9c77526a65b99d235c20cfb9ba65
SSDEEP

1536:r2Yjr1x8+Ju0XTqRc17vyW/PKhGYNlD/DRGQPsDNKm69d+:r31K+VD97vyW/KGYNVLR7N+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1052	1264	WerFault.exe	10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 1052	1264	ad2cd61d00a0f93f2e2afe42aae8980d16b83ec356b92c6d1cc17a5b4274004b.exe	28
PID 1264 wrote to memory of 1052	1264	ad2cd61d00a0f93f2e2afe42aae8980d16b83ec356b92c6d1cc17a5b4274004b.exe	28
PID 1264 wrote to memory of 1052	1264	ad2cd61d00a0f93f2e2afe42aae8980d16b83ec356b92c6d1cc17a5b4274004b.exe	28
PID 1264 wrote to memory of 1052	1264	ad2cd61d00a0f93f2e2afe42aae8980d16b83ec356b92c6d1cc17a5b4274004b.exe	28

C:\Users\Admin\AppData\Local\Temp\ad2cd61d00a0f93f2e2afe42aae8980d16b83ec356b92c6d1cc17a5b4274004b.exe
"C:\Users\Admin\AppData\Local\Temp\ad2cd61d00a0f93f2e2afe42aae8980d16b83ec356b92c6d1cc17a5b4274004b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 36
  2⤵
  - Program crash
  PID:1052

memory/1052-55-0x0000000000000000-mapping.dmp

Download
memory/1264-54-0x0000000000400000-0x000000000042D642-memory.dmp

Filesize
181KB

Download