cc0fe7aa968fae130ba0076032b211a1739538c8af46fb6ac46fad4937b7d29d

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 13:00

Target

cc0fe7aa968fae130ba0076032b211a1739538c8af46fb6ac46fad4937b7d29d.exe
Size

97KB
MD5

4bd8f5a6ffb1f43f4d80511445f3b25b
SHA1

3b099ea512eae9ee92cfcd8980913f662673f5ae
SHA256

cc0fe7aa968fae130ba0076032b211a1739538c8af46fb6ac46fad4937b7d29d
SHA512

c0cbb6c4385da99d552b0f57d235739dd749c10b96fc6ccaec895b6177791022e46e9727fc253263c7549bfca05f0900744cbd51df6e6735e47bd710af137b0a
SSDEEP

1536:FBkblh4WLb5oW9FnDH+fApdpTBvHir6aOvJ3zhB1Eq:FBkblbLdo0DH+fKdp5Hy6a0z6q

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1496	1788	WerFault.exe	19

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 1496	1788	cc0fe7aa968fae130ba0076032b211a1739538c8af46fb6ac46fad4937b7d29d.exe	27
PID 1788 wrote to memory of 1496	1788	cc0fe7aa968fae130ba0076032b211a1739538c8af46fb6ac46fad4937b7d29d.exe	27
PID 1788 wrote to memory of 1496	1788	cc0fe7aa968fae130ba0076032b211a1739538c8af46fb6ac46fad4937b7d29d.exe	27
PID 1788 wrote to memory of 1496	1788	cc0fe7aa968fae130ba0076032b211a1739538c8af46fb6ac46fad4937b7d29d.exe	27

C:\Users\Admin\AppData\Local\Temp\cc0fe7aa968fae130ba0076032b211a1739538c8af46fb6ac46fad4937b7d29d.exe
"C:\Users\Admin\AppData\Local\Temp\cc0fe7aa968fae130ba0076032b211a1739538c8af46fb6ac46fad4937b7d29d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 140
  2⤵
  - Program crash
  PID:1496

memory/1788-54-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/1788-56-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download