cdc57843b89c2d85f187f7dd1c4c4e6a3ce5033c37948a9dda3b03c2cf8cf528

Analysis

max time kernel
40s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 02:09

Target

cdc57843b89c2d85f187f7dd1c4c4e6a3ce5033c37948a9dda3b03c2cf8cf528.exe
Size

28KB
MD5

a1946bd0cf636f138f3ab2992effb776
SHA1

1415aede6c64f32d9a31d1473a7f2ed22cb5c6f0
SHA256

cdc57843b89c2d85f187f7dd1c4c4e6a3ce5033c37948a9dda3b03c2cf8cf528
SHA512

69ebd51869d26e6f9963794351a7d4f2bfaa6ff640ae0a3084e04c885befa034c9581ef3b5f0eba680db5ba8e2288ca37367acf372d3bc06071a5775a342bad3
SSDEEP

384:j9HWeV3prDKz+jamM3WtA/mq9n+i6nMj21/o:D3prDNmmMWsmqF+ijj21/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2012	1516	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 2012	1516	cdc57843b89c2d85f187f7dd1c4c4e6a3ce5033c37948a9dda3b03c2cf8cf528.exe	27
PID 1516 wrote to memory of 2012	1516	cdc57843b89c2d85f187f7dd1c4c4e6a3ce5033c37948a9dda3b03c2cf8cf528.exe	27
PID 1516 wrote to memory of 2012	1516	cdc57843b89c2d85f187f7dd1c4c4e6a3ce5033c37948a9dda3b03c2cf8cf528.exe	27
PID 1516 wrote to memory of 2012	1516	cdc57843b89c2d85f187f7dd1c4c4e6a3ce5033c37948a9dda3b03c2cf8cf528.exe	27

C:\Users\Admin\AppData\Local\Temp\cdc57843b89c2d85f187f7dd1c4c4e6a3ce5033c37948a9dda3b03c2cf8cf528.exe
"C:\Users\Admin\AppData\Local\Temp\cdc57843b89c2d85f187f7dd1c4c4e6a3ce5033c37948a9dda3b03c2cf8cf528.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 88
  2⤵
  - Program crash
  PID:2012

memory/1516-54-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download