3c23085a325c83dbcc980ca390d7aedd14a35bb67101ae8c47563cdab0390e9b

Analysis

max time kernel
26s
max time network
29s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 07:49

Target

3c23085a325c83dbcc980ca390d7aedd14a35bb67101ae8c47563cdab0390e9b.exe
Size

396KB
MD5

68cde8061bd24bae16f3b23832251a54
SHA1

68c4a3f4c79407e1ff4bd8a743898d85cd969f35
SHA256

3c23085a325c83dbcc980ca390d7aedd14a35bb67101ae8c47563cdab0390e9b
SHA512

196307fcf0c8b51d44e58b60d08696bdc319fb8c135cb5f54c6e038b833e216f093e498a96f27728d5087b108863478cec9865b2621a43a4d9211565995f8fa1
SSDEEP

12288:+qKvQDIW1OVnlNpuO5+BOdx/Fk9UIY1oo53qb7:+/vQDIW1OVnlNpQBOdx/FkCI0sb7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1764	2012	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1764	2012	3c23085a325c83dbcc980ca390d7aedd14a35bb67101ae8c47563cdab0390e9b.exe	27
PID 2012 wrote to memory of 1764	2012	3c23085a325c83dbcc980ca390d7aedd14a35bb67101ae8c47563cdab0390e9b.exe	27
PID 2012 wrote to memory of 1764	2012	3c23085a325c83dbcc980ca390d7aedd14a35bb67101ae8c47563cdab0390e9b.exe	27
PID 2012 wrote to memory of 1764	2012	3c23085a325c83dbcc980ca390d7aedd14a35bb67101ae8c47563cdab0390e9b.exe	27

C:\Users\Admin\AppData\Local\Temp\3c23085a325c83dbcc980ca390d7aedd14a35bb67101ae8c47563cdab0390e9b.exe
"C:\Users\Admin\AppData\Local\Temp\3c23085a325c83dbcc980ca390d7aedd14a35bb67101ae8c47563cdab0390e9b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 192
  2⤵
  - Program crash
  PID:1764

memory/2012-54-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download
memory/2012-55-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download