cd403e8d0858883fd9d17feacf1dfcbc57d63e0107891fa2f4f3e1a991dd5756

Analysis

max time kernel
25s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 12:36

Target

cd403e8d0858883fd9d17feacf1dfcbc57d63e0107891fa2f4f3e1a991dd5756.exe
Size

73KB
MD5

3a862e48feb11b30de058fc0a1a7145c
SHA1

b39cdfc739943578554ffee683b066825a3765a2
SHA256

cd403e8d0858883fd9d17feacf1dfcbc57d63e0107891fa2f4f3e1a991dd5756
SHA512

9705fdba9d44672a8fc3b1ef09e50e0adf470eca6d1a4eaeaf97b1ce36d6cd87479d5db7a1be77d131ea5390da17868f2681f9024a490c39b074f412c0ac87b5
SSDEEP

1536:7jpYVrXUwI1TN5Pwjjjjjjjjjjjjjjjj73IK4G6wT8V/wDaXa4uZjUvRH:4UwYvBVta4uZaH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1928	1852	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 1928	1852	cd403e8d0858883fd9d17feacf1dfcbc57d63e0107891fa2f4f3e1a991dd5756.exe	28
PID 1852 wrote to memory of 1928	1852	cd403e8d0858883fd9d17feacf1dfcbc57d63e0107891fa2f4f3e1a991dd5756.exe	28
PID 1852 wrote to memory of 1928	1852	cd403e8d0858883fd9d17feacf1dfcbc57d63e0107891fa2f4f3e1a991dd5756.exe	28
PID 1852 wrote to memory of 1928	1852	cd403e8d0858883fd9d17feacf1dfcbc57d63e0107891fa2f4f3e1a991dd5756.exe	28

C:\Users\Admin\AppData\Local\Temp\cd403e8d0858883fd9d17feacf1dfcbc57d63e0107891fa2f4f3e1a991dd5756.exe
"C:\Users\Admin\AppData\Local\Temp\cd403e8d0858883fd9d17feacf1dfcbc57d63e0107891fa2f4f3e1a991dd5756.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 124
  2⤵
  - Program crash
  PID:1928