cbdcba77ddecb0a2111a8aef2e6f47d9df49b5953819eda23d7cab3420ddcfb3

Analysis

max time kernel
35s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 17:35

Target

cbdcba77ddecb0a2111a8aef2e6f47d9df49b5953819eda23d7cab3420ddcfb3.exe
Size

331KB
MD5

e37b899055596e97b5ce15c6815e3d2e
SHA1

8a58df88edd277731687860f77897cddad4b341a
SHA256

cbdcba77ddecb0a2111a8aef2e6f47d9df49b5953819eda23d7cab3420ddcfb3
SHA512

a5a36fcf65f5e12ac474c5474046b52399dde84b4a6d0d0a6ac7937f334180b244668efce8da580a2132f0d01e60f7a39161cbe37f2d7f4a387d717e605d0a7e
SSDEEP

3072:9pDS7Xba3zCFQovNCAHlbg4dQFiF6TE9gXvHTZqJypGuto:KDbaDJovNCAHlzQFi6Sqh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1812	364	WerFault.exe	12

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 1812	364	cbdcba77ddecb0a2111a8aef2e6f47d9df49b5953819eda23d7cab3420ddcfb3.exe	26
PID 364 wrote to memory of 1812	364	cbdcba77ddecb0a2111a8aef2e6f47d9df49b5953819eda23d7cab3420ddcfb3.exe	26
PID 364 wrote to memory of 1812	364	cbdcba77ddecb0a2111a8aef2e6f47d9df49b5953819eda23d7cab3420ddcfb3.exe	26
PID 364 wrote to memory of 1812	364	cbdcba77ddecb0a2111a8aef2e6f47d9df49b5953819eda23d7cab3420ddcfb3.exe	26

C:\Users\Admin\AppData\Local\Temp\cbdcba77ddecb0a2111a8aef2e6f47d9df49b5953819eda23d7cab3420ddcfb3.exe
"C:\Users\Admin\AppData\Local\Temp\cbdcba77ddecb0a2111a8aef2e6f47d9df49b5953819eda23d7cab3420ddcfb3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 364 -s 120
  2⤵
  - Program crash
  PID:1812

memory/364-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/364-55-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download