c3d08dfbc1616434a8a6f8687264a68666808dcdde41f8d4f2cdc0a15c678708

Analysis

max time kernel
3s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 08:01

Target

c3d08dfbc1616434a8a6f8687264a68666808dcdde41f8d4f2cdc0a15c678708.exe
Size

24KB
MD5

a2113e16fd86a9d7122ed29883e82c6e
SHA1

5a8c273337b9ff3448b5fda96ef9a10d19568744
SHA256

c3d08dfbc1616434a8a6f8687264a68666808dcdde41f8d4f2cdc0a15c678708
SHA512

caa41a7e11d1b13678211cdf8a69300dc89db2eac933cf23cfacc55f3597372e54f550d9ac6d9a4fdecf55eb9835e220d12968032dc9be1182eb495934c5ea46
SSDEEP

6:iz3SsEu9/YM+VS2eApxOj2BORIBvuJKQmQ:wT9/YMFW/aWORIBvuJ5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
944	1368	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 944	1368	c3d08dfbc1616434a8a6f8687264a68666808dcdde41f8d4f2cdc0a15c678708.exe	28
PID 1368 wrote to memory of 944	1368	c3d08dfbc1616434a8a6f8687264a68666808dcdde41f8d4f2cdc0a15c678708.exe	28
PID 1368 wrote to memory of 944	1368	c3d08dfbc1616434a8a6f8687264a68666808dcdde41f8d4f2cdc0a15c678708.exe	28
PID 1368 wrote to memory of 944	1368	c3d08dfbc1616434a8a6f8687264a68666808dcdde41f8d4f2cdc0a15c678708.exe	28

C:\Users\Admin\AppData\Local\Temp\c3d08dfbc1616434a8a6f8687264a68666808dcdde41f8d4f2cdc0a15c678708.exe
"C:\Users\Admin\AppData\Local\Temp\c3d08dfbc1616434a8a6f8687264a68666808dcdde41f8d4f2cdc0a15c678708.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 88
  2⤵
  - Program crash
  PID:944

memory/1368-55-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download