ca36b4b2faee3ef5cfbe935b75bc9926b6ddf5c2ab8df43e4a29e5c96bb01eae

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 05:13

Target

ca36b4b2faee3ef5cfbe935b75bc9926b6ddf5c2ab8df43e4a29e5c96bb01eae.exe
Size

128KB
MD5

2a8518bc555d20abc4ca174860dac87b
SHA1

9a62af62097e126dc4045e0f9eef0a61a4679975
SHA256

ca36b4b2faee3ef5cfbe935b75bc9926b6ddf5c2ab8df43e4a29e5c96bb01eae
SHA512

2328a0e7d15b7db058ee6a38374baec9376e8f0f2b8630b4ca41f3f8d618c9ad3c56041a295a3920c9b0150538c82a17a78af255b38c693421911d83f7f9bbf4
SSDEEP

1536:cb4lwkb00XQu/CD/jbld3xbvj3LNvjFkWUDEqTDEmtYhBX53:ciD0Xu/I/jbl1xbvj3pCDTTptGBJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1936	1976	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1936	1976	ca36b4b2faee3ef5cfbe935b75bc9926b6ddf5c2ab8df43e4a29e5c96bb01eae.exe	28
PID 1976 wrote to memory of 1936	1976	ca36b4b2faee3ef5cfbe935b75bc9926b6ddf5c2ab8df43e4a29e5c96bb01eae.exe	28
PID 1976 wrote to memory of 1936	1976	ca36b4b2faee3ef5cfbe935b75bc9926b6ddf5c2ab8df43e4a29e5c96bb01eae.exe	28
PID 1976 wrote to memory of 1936	1976	ca36b4b2faee3ef5cfbe935b75bc9926b6ddf5c2ab8df43e4a29e5c96bb01eae.exe	28

C:\Users\Admin\AppData\Local\Temp\ca36b4b2faee3ef5cfbe935b75bc9926b6ddf5c2ab8df43e4a29e5c96bb01eae.exe
"C:\Users\Admin\AppData\Local\Temp\ca36b4b2faee3ef5cfbe935b75bc9926b6ddf5c2ab8df43e4a29e5c96bb01eae.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 36
  2⤵
  - Program crash
  PID:1936