ce210ca14d169f8d28484f7052226ed737859c0afb71ad45790772e40057e643

Analysis

max time kernel
42s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 08:26

Target

ce210ca14d169f8d28484f7052226ed737859c0afb71ad45790772e40057e643.exe
Size

214KB
MD5

9d7d3c3885cada5d9b0a4b7f0e1ed568
SHA1

463d0071f2d1fa805a03aab5ed1847cbb90f12b2
SHA256

ce210ca14d169f8d28484f7052226ed737859c0afb71ad45790772e40057e643
SHA512

a15c88145d5c4b00a483afc238b424f6ff7b60f4e7710d96e8d75106b000f2f279b8dfc66d5933faf95bf507f055420f9b1ec117617241fc7fec32be6180a4c0
SSDEEP

6144:4eL+aokRqaPOWG8Uo7d64OQQLy1Os9rLRPj3Q:ZL+/aPOz07d6tpy1jHRU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1080	2016	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1080	2016	ce210ca14d169f8d28484f7052226ed737859c0afb71ad45790772e40057e643.exe	26
PID 2016 wrote to memory of 1080	2016	ce210ca14d169f8d28484f7052226ed737859c0afb71ad45790772e40057e643.exe	26
PID 2016 wrote to memory of 1080	2016	ce210ca14d169f8d28484f7052226ed737859c0afb71ad45790772e40057e643.exe	26
PID 2016 wrote to memory of 1080	2016	ce210ca14d169f8d28484f7052226ed737859c0afb71ad45790772e40057e643.exe	26

C:\Users\Admin\AppData\Local\Temp\ce210ca14d169f8d28484f7052226ed737859c0afb71ad45790772e40057e643.exe
"C:\Users\Admin\AppData\Local\Temp\ce210ca14d169f8d28484f7052226ed737859c0afb71ad45790772e40057e643.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 36
  2⤵
  - Program crash
  PID:1080

memory/2016-55-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download