cd7124d09a860f870cd3e93503d8d3388f52653f7b2881f002be0dd4e190fbbf

Analysis

max time kernel
29s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 08:23

Target

cd7124d09a860f870cd3e93503d8d3388f52653f7b2881f002be0dd4e190fbbf.exe
Size

323KB
MD5

c5d222e81e9590622eff316c72942105
SHA1

48258378ffc7af2a9c3e46a5e19c5f982fae1d7a
SHA256

cd7124d09a860f870cd3e93503d8d3388f52653f7b2881f002be0dd4e190fbbf
SHA512

6713c918977dff8a4a9e229a02dca4add763c3d88a26aeafdcb4335f2536241b8c0e6d8d71e55eef6b5a636cfed2842556b11d8f9c5ab96fefd87dbe1386eb48
SSDEEP

6144:+aW1LUrrJUCJsc3/12zTOW932xKndl4G3+o4ADKJ0OF:gLIUascPkvOKcKnQGF4ADKJ0OF

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1632	1532	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 1632	1532	cd7124d09a860f870cd3e93503d8d3388f52653f7b2881f002be0dd4e190fbbf.exe	28
PID 1532 wrote to memory of 1632	1532	cd7124d09a860f870cd3e93503d8d3388f52653f7b2881f002be0dd4e190fbbf.exe	28
PID 1532 wrote to memory of 1632	1532	cd7124d09a860f870cd3e93503d8d3388f52653f7b2881f002be0dd4e190fbbf.exe	28
PID 1532 wrote to memory of 1632	1532	cd7124d09a860f870cd3e93503d8d3388f52653f7b2881f002be0dd4e190fbbf.exe	28

C:\Users\Admin\AppData\Local\Temp\cd7124d09a860f870cd3e93503d8d3388f52653f7b2881f002be0dd4e190fbbf.exe
"C:\Users\Admin\AppData\Local\Temp\cd7124d09a860f870cd3e93503d8d3388f52653f7b2881f002be0dd4e190fbbf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 36
  2⤵
  - Program crash
  PID:1632

memory/1532-55-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download