21ac3d12feacde6639ea7d1bdef1bf44ecfceb52ed14c31d5282f594b48d443f

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
13/11/2023, 03:18

Target

cdaa965a3e9d934a83d5487053d8a283.exe
Size

3.9MB
MD5

cdaa965a3e9d934a83d5487053d8a283
SHA1

ad3d9d22f8e2aec207584b32bf17a3d06e3510c0
SHA256

21ac3d12feacde6639ea7d1bdef1bf44ecfceb52ed14c31d5282f594b48d443f
SHA512

2b02c9761c2532fc223404c947a82efb68beecc93d9927c20caf4e9cb87661889912f400f3225d6d10fd7563b52d364609d541c64da87d61c6c4652d41344d7f
SSDEEP

6144:9Z4ZJ7oMzXpdF2AX2RvzI4TJu1lnTZc4Gl1TOh2P2Kbnh2:9a8wpCRv9MnTZc4Gl1TLjbh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1764	3052	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 1764	3052	cdaa965a3e9d934a83d5487053d8a283.exe	28
PID 3052 wrote to memory of 1764	3052	cdaa965a3e9d934a83d5487053d8a283.exe	28
PID 3052 wrote to memory of 1764	3052	cdaa965a3e9d934a83d5487053d8a283.exe	28
PID 3052 wrote to memory of 1764	3052	cdaa965a3e9d934a83d5487053d8a283.exe	28

C:\Users\Admin\AppData\Local\Temp\cdaa965a3e9d934a83d5487053d8a283.exe
"C:\Users\Admin\AppData\Local\Temp\cdaa965a3e9d934a83d5487053d8a283.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 36
  2⤵
  - Program crash
  PID:1764