c2bffc25b2f9f547e4578a4998af68c8db389638151855b102bfb845aadbab8f

Analysis

max time kernel
31s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 00:59

Target

c2bffc25b2f9f547e4578a4998af68c8db389638151855b102bfb845aadbab8f.exe
Size

335KB
MD5

b5032169747f2c5ec0ee51b1e69cab40
SHA1

2a2c46611bdad227a1c29c5908adb6aa59517411
SHA256

c2bffc25b2f9f547e4578a4998af68c8db389638151855b102bfb845aadbab8f
SHA512

cb6ae84058538288a160deed919ea859a52842efb083757da10d6bf68108983376f5e2c3d9f5e14d82decf3d449401550670fb05540324104671f072d0a3d9d0
SSDEEP

6144:wPIEaBPMyt2NbUN6zA03AI+tU0SbscTdJUTXTvTnTmTMTdTK7G6RZ:wPIEa54vzAHI+csWdJujbTAmpKbv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1988	1628	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1988	1628	c2bffc25b2f9f547e4578a4998af68c8db389638151855b102bfb845aadbab8f.exe	28
PID 1628 wrote to memory of 1988	1628	c2bffc25b2f9f547e4578a4998af68c8db389638151855b102bfb845aadbab8f.exe	28
PID 1628 wrote to memory of 1988	1628	c2bffc25b2f9f547e4578a4998af68c8db389638151855b102bfb845aadbab8f.exe	28
PID 1628 wrote to memory of 1988	1628	c2bffc25b2f9f547e4578a4998af68c8db389638151855b102bfb845aadbab8f.exe	28

C:\Users\Admin\AppData\Local\Temp\c2bffc25b2f9f547e4578a4998af68c8db389638151855b102bfb845aadbab8f.exe
"C:\Users\Admin\AppData\Local\Temp\c2bffc25b2f9f547e4578a4998af68c8db389638151855b102bfb845aadbab8f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 136
  2⤵
  - Program crash
  PID:1988

memory/1628-54-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/1628-56-0x0000000001280000-0x00000000012B3000-memory.dmp

Filesize
204KB

Download