cad4d700f94998a6271c991354da679ac53ab92f6e993a5a39751907d535f760

Analysis

max time kernel
26s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 08:26

Target

cad4d700f94998a6271c991354da679ac53ab92f6e993a5a39751907d535f760.exe
Size

214KB
MD5

cb2e8f3d0a143b6165a9f9ff53b6600c
SHA1

23f3dff733cf6422a16206ddedf904a092133ee5
SHA256

cad4d700f94998a6271c991354da679ac53ab92f6e993a5a39751907d535f760
SHA512

4a50e1edd142aaef88122e406f471e6c0b4571fdaae1349d1c495d59a578d7b786b004051f5de88c5198f65e85091e6660d38cb77accb4e05caf609e811e3cd5
SSDEEP

6144:w1hNDgGGFotA9VJoRt6x1I10XH1v3tOT:whDaoq9o6xQY3t

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1972	2008	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1972	2008	cad4d700f94998a6271c991354da679ac53ab92f6e993a5a39751907d535f760.exe	28
PID 2008 wrote to memory of 1972	2008	cad4d700f94998a6271c991354da679ac53ab92f6e993a5a39751907d535f760.exe	28
PID 2008 wrote to memory of 1972	2008	cad4d700f94998a6271c991354da679ac53ab92f6e993a5a39751907d535f760.exe	28
PID 2008 wrote to memory of 1972	2008	cad4d700f94998a6271c991354da679ac53ab92f6e993a5a39751907d535f760.exe	28

C:\Users\Admin\AppData\Local\Temp\cad4d700f94998a6271c991354da679ac53ab92f6e993a5a39751907d535f760.exe
"C:\Users\Admin\AppData\Local\Temp\cad4d700f94998a6271c991354da679ac53ab92f6e993a5a39751907d535f760.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 36
  2⤵
  - Program crash
  PID:1972

memory/2008-54-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download