cac7128db4af77a4049186de26994322f51d24079f3a010ea4ea2833f39eed38

Analysis

max time kernel
55s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 08:40

Target

cac7128db4af77a4049186de26994322f51d24079f3a010ea4ea2833f39eed38.exe
Size

76KB
MD5

8a0ba3ea3f36b3ad9b80cd9560d6ae4b
SHA1

0da50ee4bde58a1f11711b5d7980df9a0609e0ee
SHA256

cac7128db4af77a4049186de26994322f51d24079f3a010ea4ea2833f39eed38
SHA512

fa4603aa6fae2e968a883fc92e60c7769139d77b8f7d5f8e43a0f913a26b86a8d91fc3d7287d9d12e3bcd2704b862e66268dcf793786b9df55147d9e97e33827
SSDEEP

1536:nUUUUOfuckfwezrsJs7PWM3kLstrjCioIEZ0FGuuypjVrs2ryrd1vUQuq6:R9fnrvPWykL0jVEZ0FwyHs2qo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
584	1672	WerFault.exe	22

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 584	1672	cac7128db4af77a4049186de26994322f51d24079f3a010ea4ea2833f39eed38.exe	28
PID 1672 wrote to memory of 584	1672	cac7128db4af77a4049186de26994322f51d24079f3a010ea4ea2833f39eed38.exe	28
PID 1672 wrote to memory of 584	1672	cac7128db4af77a4049186de26994322f51d24079f3a010ea4ea2833f39eed38.exe	28
PID 1672 wrote to memory of 584	1672	cac7128db4af77a4049186de26994322f51d24079f3a010ea4ea2833f39eed38.exe	28

C:\Users\Admin\AppData\Local\Temp\cac7128db4af77a4049186de26994322f51d24079f3a010ea4ea2833f39eed38.exe
"C:\Users\Admin\AppData\Local\Temp\cac7128db4af77a4049186de26994322f51d24079f3a010ea4ea2833f39eed38.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 36
  2⤵
  - Program crash
  PID:584

memory/584-55-0x0000000000000000-mapping.dmp

Download
memory/1672-54-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download