22181c3078de3df406f094899b2032b946d1472a40d3d0349757d9c759d29ce4

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
05/08/2023, 09:57

Target

22181c3078de3df406f094899b2032b946d1472a40d3d0349757d9c759d29ce4_JC.exe
Size

1004KB
MD5

9baaf9ce29d4a8705480e07654de6dbc
SHA1

a49162258cc8914658acc063791d200e8045e91e
SHA256

22181c3078de3df406f094899b2032b946d1472a40d3d0349757d9c759d29ce4
SHA512

a13b654680066e79142c481d4fa5c6add1621444bfa27bccfc260e9d0337a69284569275e5ebbe731bb63fa01aafa43319323b4a979123ac0fd212b39ae72db0
SSDEEP

24576:fjOMxVhSBEY/VPyn1RLp1+ONydmNWoqeW6tJO6:nCEY/Ad1+RmWCC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1608	2980	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 1608	2980	22181c3078de3df406f094899b2032b946d1472a40d3d0349757d9c759d29ce4_JC.exe	30
PID 2980 wrote to memory of 1608	2980	22181c3078de3df406f094899b2032b946d1472a40d3d0349757d9c759d29ce4_JC.exe	30
PID 2980 wrote to memory of 1608	2980	22181c3078de3df406f094899b2032b946d1472a40d3d0349757d9c759d29ce4_JC.exe	30
PID 2980 wrote to memory of 1608	2980	22181c3078de3df406f094899b2032b946d1472a40d3d0349757d9c759d29ce4_JC.exe	30

C:\Users\Admin\AppData\Local\Temp\22181c3078de3df406f094899b2032b946d1472a40d3d0349757d9c759d29ce4_JC.exe
"C:\Users\Admin\AppData\Local\Temp\22181c3078de3df406f094899b2032b946d1472a40d3d0349757d9c759d29ce4_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 652
  2⤵
  - Program crash
  PID:1608

memory/2980-53-0x0000000074300000-0x00000000749EE000-memory.dmp

Filesize
6.9MB

Download
memory/2980-54-0x0000000000990000-0x0000000000A90000-memory.dmp

Filesize
1024KB

Download
memory/2980-55-0x0000000004E90000-0x0000000004ED0000-memory.dmp

Filesize
256KB

Download
memory/2980-56-0x0000000000410000-0x0000000000420000-memory.dmp

Filesize
64KB

Download
memory/2980-57-0x0000000074300000-0x00000000749EE000-memory.dmp

Filesize
6.9MB

Download
memory/2980-58-0x0000000004E90000-0x0000000004ED0000-memory.dmp

Filesize
256KB

Download
memory/2980-59-0x0000000000470000-0x000000000047A000-memory.dmp

Filesize
40KB

Download