ce6c5c776919047274cdf26b1483270baaae134b048cf182832e7d2f51fbb24c

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 07:13

Target

ce6c5c776919047274cdf26b1483270baaae134b048cf182832e7d2f51fbb24c.exe
Size

516KB
MD5

080908bb3fd1d48c317e947cd0299bbc
SHA1

eafaea2d2c6ddfe20739e8c995ee4c18a637203a
SHA256

ce6c5c776919047274cdf26b1483270baaae134b048cf182832e7d2f51fbb24c
SHA512

0fd5663c1c7ffe6b575d6858490c040b8f1ae18380a8b54fb7b88bbeb5473391b15b7e504bc62e2a534dd06d7b407b9cef03440e239faaef309ce7bf5cbf6f12
SSDEEP

12288:P+kJKmskUFFsKKBF6hTOsZfEY3M88bXtJTnQoY:WSGPFblh5Zfl8nznd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1672	240	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 240 wrote to memory of 1672	240	ce6c5c776919047274cdf26b1483270baaae134b048cf182832e7d2f51fbb24c.exe	28
PID 240 wrote to memory of 1672	240	ce6c5c776919047274cdf26b1483270baaae134b048cf182832e7d2f51fbb24c.exe	28
PID 240 wrote to memory of 1672	240	ce6c5c776919047274cdf26b1483270baaae134b048cf182832e7d2f51fbb24c.exe	28
PID 240 wrote to memory of 1672	240	ce6c5c776919047274cdf26b1483270baaae134b048cf182832e7d2f51fbb24c.exe	28

C:\Users\Admin\AppData\Local\Temp\ce6c5c776919047274cdf26b1483270baaae134b048cf182832e7d2f51fbb24c.exe
"C:\Users\Admin\AppData\Local\Temp\ce6c5c776919047274cdf26b1483270baaae134b048cf182832e7d2f51fbb24c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 240 -s 220
  2⤵
  - Program crash
  PID:1672

memory/240-54-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/1672-55-0x0000000000000000-mapping.dmp

Download