cf1b3690c4b4c42487454b73df08ffb322da59f731f290c12923993ef189f745

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 08:45

Target

cf1b3690c4b4c42487454b73df08ffb322da59f731f290c12923993ef189f745.exe
Size

56KB
MD5

507970a420e998e3f95abf46b4646100
SHA1

1a19bf19f49a33a35ac18c577c0dea78df454aeb
SHA256

cf1b3690c4b4c42487454b73df08ffb322da59f731f290c12923993ef189f745
SHA512

fb5cf75c6342dc2120c659990433973297d4872b1231a272b27ec96f6e701074f8d90ff74f03e393daa0fff56a2e54fbdd67e7a9a088d36f32b2a0f7085ed301
SSDEEP

768:XYI6KVr/pGnUdJMpJZPJJNITZVECZa2CdY0fEEHdbM3gPnX/M51nRG3dC9JfNQQC:I0CW+pHiQ/XEDnRGQ1Q45Cas6rx2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1344	1204	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1344	1204	cf1b3690c4b4c42487454b73df08ffb322da59f731f290c12923993ef189f745.exe	27
PID 1204 wrote to memory of 1344	1204	cf1b3690c4b4c42487454b73df08ffb322da59f731f290c12923993ef189f745.exe	27
PID 1204 wrote to memory of 1344	1204	cf1b3690c4b4c42487454b73df08ffb322da59f731f290c12923993ef189f745.exe	27
PID 1204 wrote to memory of 1344	1204	cf1b3690c4b4c42487454b73df08ffb322da59f731f290c12923993ef189f745.exe	27

C:\Users\Admin\AppData\Local\Temp\cf1b3690c4b4c42487454b73df08ffb322da59f731f290c12923993ef189f745.exe
"C:\Users\Admin\AppData\Local\Temp\cf1b3690c4b4c42487454b73df08ffb322da59f731f290c12923993ef189f745.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 36
  2⤵
  - Program crash
  PID:1344