c2a3c623f6a32241ebf219627a8f48cbb022ca490d16aba5c2be603043989b2a

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
20/09/2023, 11:25

Target

c2a3c623f6a32241ebf219627a8f48cbb022ca490d16aba5c2be603043989b2a.exe
Size

5KB
MD5

4a1201444aacb7b3e1119c68d47b6879
SHA1

1ffc13f721a8357706bdd1c5726e776fd252ae84
SHA256

c2a3c623f6a32241ebf219627a8f48cbb022ca490d16aba5c2be603043989b2a
SHA512

764b78b26cb4a4520682354b7ff67181267cd00a6c3813afd88ddeb7f2afbe54f9aae5f8a7b17f0d7d5847c350c82b6b7bc7fa36de6c2e30ddd76a22e442939a
SSDEEP

48:SXlXWFPpT+dXVfzZh4yMGcKzMEkTaak4PAZivO2pB42pBdvMZL2R7tYRuqSxp:cWLkFfNnOKYloIQ2pm2pbYS8xE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2184	2264	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2184	2264	c2a3c623f6a32241ebf219627a8f48cbb022ca490d16aba5c2be603043989b2a.exe	28
PID 2264 wrote to memory of 2184	2264	c2a3c623f6a32241ebf219627a8f48cbb022ca490d16aba5c2be603043989b2a.exe	28
PID 2264 wrote to memory of 2184	2264	c2a3c623f6a32241ebf219627a8f48cbb022ca490d16aba5c2be603043989b2a.exe	28
PID 2264 wrote to memory of 2184	2264	c2a3c623f6a32241ebf219627a8f48cbb022ca490d16aba5c2be603043989b2a.exe	28

C:\Users\Admin\AppData\Local\Temp\c2a3c623f6a32241ebf219627a8f48cbb022ca490d16aba5c2be603043989b2a.exe
"C:\Users\Admin\AppData\Local\Temp\c2a3c623f6a32241ebf219627a8f48cbb022ca490d16aba5c2be603043989b2a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 48
  2⤵
  - Program crash
  PID:2184