c338053c9efcc6f02bcbd95ce831c6b614109254cf6ca7ed22439a3eaefe2809

Analysis

max time kernel
56s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 08:24

Target

c338053c9efcc6f02bcbd95ce831c6b614109254cf6ca7ed22439a3eaefe2809.exe
Size

346KB
MD5

c570c4bce0ee8612d89512748fa42d3a
SHA1

c4d8d3b56f3409b773937178d54d0e49a4b63fc6
SHA256

c338053c9efcc6f02bcbd95ce831c6b614109254cf6ca7ed22439a3eaefe2809
SHA512

9bc6f4111c4b08a6aed5a88f3f7209f9ea99ad9e4dc1b1ec43ad7f4f0a30037bb3ca72c05f4687d10c8895e48e668aebee208de3833e3d161ef38d622023ecdc
SSDEEP

6144:I7vhd2s1TSEyWrnx8/kezjZqgDiofXf/Y9OKHSzm:82WDx4ZqIi6wOaE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
676	836	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 676	836	c338053c9efcc6f02bcbd95ce831c6b614109254cf6ca7ed22439a3eaefe2809.exe	28
PID 836 wrote to memory of 676	836	c338053c9efcc6f02bcbd95ce831c6b614109254cf6ca7ed22439a3eaefe2809.exe	28
PID 836 wrote to memory of 676	836	c338053c9efcc6f02bcbd95ce831c6b614109254cf6ca7ed22439a3eaefe2809.exe	28
PID 836 wrote to memory of 676	836	c338053c9efcc6f02bcbd95ce831c6b614109254cf6ca7ed22439a3eaefe2809.exe	28

C:\Users\Admin\AppData\Local\Temp\c338053c9efcc6f02bcbd95ce831c6b614109254cf6ca7ed22439a3eaefe2809.exe
"C:\Users\Admin\AppData\Local\Temp\c338053c9efcc6f02bcbd95ce831c6b614109254cf6ca7ed22439a3eaefe2809.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 164
  2⤵
  - Program crash
  PID:676

memory/836-54-0x0000000001000000-0x00000000010A5000-memory.dmp

Filesize
660KB

Download
memory/836-55-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/836-57-0x0000000001000000-0x00000000010A5000-memory.dmp

Filesize
660KB

Download