2601ccb552a5bbda655b2638f73c0c0ab6fa0569b232f32e4a179ed6045957ec

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
10-07-2023 15:11

Target

cbd7e841f0c2bdexeexeexeex.exe
Size

335KB
MD5

cbd7e841f0c2bd0e72923c34040d5470
SHA1

f2845d06da95caf0b884ffbb742a364d096b9c3e
SHA256

2601ccb552a5bbda655b2638f73c0c0ab6fa0569b232f32e4a179ed6045957ec
SHA512

f3d373915e8da68f2adb773b3ef6a95dcebced77c4bc2e36e5c9a47dfada7635dfca00dfc19d91539ebad6a7f2e1a54a573e658113bf674dee2be06c1145f392
SSDEEP

6144:qtUGfUWOeEBUEhLkXj3zRG6yLQ/UNP4H2CiTT810qhh4wAjrt:qtUGfVwUFzRG6EQ0POfiTTM0qZAjrt

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2332 3016 WerFault.exe cbd7e841f0c2bdexeexeexeex.exe

pid	pid_target	process	target process
2332	3016	WerFault.exe	cbd7e841f0c2bdexeexeexeex.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cbd7e841f0c2bdexeexeexeex.exe

description	pid	process	target process
PID 3016 wrote to memory of 2332	3016	cbd7e841f0c2bdexeexeexeex.exe	WerFault.exe
PID 3016 wrote to memory of 2332	3016	cbd7e841f0c2bdexeexeexeex.exe	WerFault.exe
PID 3016 wrote to memory of 2332	3016	cbd7e841f0c2bdexeexeexeex.exe	WerFault.exe
PID 3016 wrote to memory of 2332	3016	cbd7e841f0c2bdexeexeexeex.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\cbd7e841f0c2bdexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\cbd7e841f0c2bdexeexeexeex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 120
2⤵
- Program crash
PID:2332