ca3d8632555bd825dd64553944b82ec5d67cd19a77ec9dd8b5260f5137b88f04

Analysis

max time kernel
37s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 05:19

Target

ca3d8632555bd825dd64553944b82ec5d67cd19a77ec9dd8b5260f5137b88f04.exe
Size

96KB
MD5

59807b542db0a509a62076e21a636f79
SHA1

20f50584c7a4e6e98f6ccdddff80a5d07c182b60
SHA256

ca3d8632555bd825dd64553944b82ec5d67cd19a77ec9dd8b5260f5137b88f04
SHA512

2fb787cdd79a1e9e654eff91d69f5cc30c7f0e88b21dd79640a8d0f906bc69aee81ba7f05b96f16020e59f0a6ced41beb2ee9512dcd07e3f5b8a602aaa730445
SSDEEP

768:6H6q6PQ5Qb7DwhTqgeSxKc+vFl9fkslORY+a+8xy9jp0uM4FK2KSokrVkFuWC0R7:A6qUQqb77eDihWmxy9jp00FK2K7UAmy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1752	1100	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 1752	1100	ca3d8632555bd825dd64553944b82ec5d67cd19a77ec9dd8b5260f5137b88f04.exe	29
PID 1100 wrote to memory of 1752	1100	ca3d8632555bd825dd64553944b82ec5d67cd19a77ec9dd8b5260f5137b88f04.exe	29
PID 1100 wrote to memory of 1752	1100	ca3d8632555bd825dd64553944b82ec5d67cd19a77ec9dd8b5260f5137b88f04.exe	29
PID 1100 wrote to memory of 1752	1100	ca3d8632555bd825dd64553944b82ec5d67cd19a77ec9dd8b5260f5137b88f04.exe	29

C:\Users\Admin\AppData\Local\Temp\ca3d8632555bd825dd64553944b82ec5d67cd19a77ec9dd8b5260f5137b88f04.exe
"C:\Users\Admin\AppData\Local\Temp\ca3d8632555bd825dd64553944b82ec5d67cd19a77ec9dd8b5260f5137b88f04.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 600
  2⤵
  - Program crash
  PID:1752

memory/1100-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/1100-55-0x0000000008390000-0x00000000083A8000-memory.dmp

Filesize
96KB

Download