3ca9fc9c3d691f82f077e81c91b5b695960111ca6d273fd7b9132185d61cff24

Analysis

max time kernel
40s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 17:09

Target

3ca9fc9c3d691f82f077e81c91b5b695960111ca6d273fd7b9132185d61cff24.exe
Size

28KB
MD5

6d68e745d94eda122c4c60e1458a319f
SHA1

5eeac907ef77f08320f4773d2762489c60d6f9b8
SHA256

3ca9fc9c3d691f82f077e81c91b5b695960111ca6d273fd7b9132185d61cff24
SHA512

8537988944ea7e221e803905925c87b53a0eeba1aa9777c1fe1d2953a28825a298cb50ed1d73ff7beccdc134b09a61e2740798068a601aa988fcff7fe163ee04
SSDEEP

384:tGp5CRi8L3ai7CUWdC5WELyTd5UOt2OLBMiIGFBXaTldIIo/r2dDnr:2kL3PXYC5tQdF2OLBeGF9aTldIaH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
964	1184	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 964	1184	3ca9fc9c3d691f82f077e81c91b5b695960111ca6d273fd7b9132185d61cff24.exe	26
PID 1184 wrote to memory of 964	1184	3ca9fc9c3d691f82f077e81c91b5b695960111ca6d273fd7b9132185d61cff24.exe	26
PID 1184 wrote to memory of 964	1184	3ca9fc9c3d691f82f077e81c91b5b695960111ca6d273fd7b9132185d61cff24.exe	26
PID 1184 wrote to memory of 964	1184	3ca9fc9c3d691f82f077e81c91b5b695960111ca6d273fd7b9132185d61cff24.exe	26

C:\Users\Admin\AppData\Local\Temp\3ca9fc9c3d691f82f077e81c91b5b695960111ca6d273fd7b9132185d61cff24.exe
"C:\Users\Admin\AppData\Local\Temp\3ca9fc9c3d691f82f077e81c91b5b695960111ca6d273fd7b9132185d61cff24.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1184 -s 88
  2⤵
  - Program crash
  PID:964

memory/1184-55-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download