c7afcd82f36ccadc7dceeaf250ced8ddc900ff52a17805519f0f80286d28bd5b

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 06:12

Target

c7afcd82f36ccadc7dceeaf250ced8ddc900ff52a17805519f0f80286d28bd5b.exe
Size

393KB
MD5

dd278605b487612f5d5d71d8b7679f0c
SHA1

01084a28c43d294db31109dcf090af12705a0fea
SHA256

c7afcd82f36ccadc7dceeaf250ced8ddc900ff52a17805519f0f80286d28bd5b
SHA512

7fd5c1b15d3012fc8402618e7099a982342ad4976566e7ba2871d9229e1ee7199d8d4715b2e77ef8bfedb6ef5080f6d1274ea4e04cf12b012c22ebc2b285c83c
SSDEEP

3072:F5cqmj89QdEQiynHlgyyzc8B6AeZYnycHve24UaftFVRr92kR/HpXnAnZFmZ/Rnd:Fg89Qgu5dAe23HveGaft+k1HpqFgz

Score

4^/10

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\hpig_WS2.dat	c7afcd82f36ccadc7dceeaf250ced8ddc900ff52a17805519f0f80286d28bd5b.exe
File created	C:\Windows\my_sfc_os.dll	c7afcd82f36ccadc7dceeaf250ced8ddc900ff52a17805519f0f80286d28bd5b.exe
File opened for modification	C:\Windows\my_sfc_os.dll	c7afcd82f36ccadc7dceeaf250ced8ddc900ff52a17805519f0f80286d28bd5b.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1680	744	WerFault.exe	19

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 1680	744	c7afcd82f36ccadc7dceeaf250ced8ddc900ff52a17805519f0f80286d28bd5b.exe	28
PID 744 wrote to memory of 1680	744	c7afcd82f36ccadc7dceeaf250ced8ddc900ff52a17805519f0f80286d28bd5b.exe	28
PID 744 wrote to memory of 1680	744	c7afcd82f36ccadc7dceeaf250ced8ddc900ff52a17805519f0f80286d28bd5b.exe	28
PID 744 wrote to memory of 1680	744	c7afcd82f36ccadc7dceeaf250ced8ddc900ff52a17805519f0f80286d28bd5b.exe	28

C:\Users\Admin\AppData\Local\Temp\c7afcd82f36ccadc7dceeaf250ced8ddc900ff52a17805519f0f80286d28bd5b.exe
"C:\Users\Admin\AppData\Local\Temp\c7afcd82f36ccadc7dceeaf250ced8ddc900ff52a17805519f0f80286d28bd5b.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 744 -s 152
  2⤵
  - Program crash
  PID:1680

memory/744-54-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Filesize
8KB

Download
memory/744-55-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/744-57-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download