cbf9d75af2609459748540336ea9e36fb69f259f531d62e291b26f86adf4171f

Analysis

max time kernel
7s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 21:11

Target

cbf9d75af2609459748540336ea9e36fb69f259f531d62e291b26f86adf4171f.exe
Size

453KB
MD5

cc1ade6f112a97d58b7ec63929990e9f
SHA1

5a5af52a80b90408ccdf7ca3c0a6db496d73df21
SHA256

cbf9d75af2609459748540336ea9e36fb69f259f531d62e291b26f86adf4171f
SHA512

20b99dd5319c54e899630346594bfc8f598869afd59ab5852f320efa6d736b21701d028d03fa3ba43106710c2c588768dbdabd0baf9193f5abd9b794d6c1a9a7
SSDEEP

6144:DI0gDRgIjmqEhgcCU3ehN8vU8+MfbTJ9C2YbBlAqVWC/vKrky8tNenvFWcc:WDeIjwCaOsVbTLYbBxtg8tG3c

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1780	1884	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 1780	1884	cbf9d75af2609459748540336ea9e36fb69f259f531d62e291b26f86adf4171f.exe	28
PID 1884 wrote to memory of 1780	1884	cbf9d75af2609459748540336ea9e36fb69f259f531d62e291b26f86adf4171f.exe	28
PID 1884 wrote to memory of 1780	1884	cbf9d75af2609459748540336ea9e36fb69f259f531d62e291b26f86adf4171f.exe	28
PID 1884 wrote to memory of 1780	1884	cbf9d75af2609459748540336ea9e36fb69f259f531d62e291b26f86adf4171f.exe	28

C:\Users\Admin\AppData\Local\Temp\cbf9d75af2609459748540336ea9e36fb69f259f531d62e291b26f86adf4171f.exe
"C:\Users\Admin\AppData\Local\Temp\cbf9d75af2609459748540336ea9e36fb69f259f531d62e291b26f86adf4171f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 36
  2⤵
  - Program crash
  PID:1780