cfe8d0b1bb1ab8462a211773a1e8a701f1a921c077bb4b3aa6eab77afd1d434f

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 11:40

Target

c344b7362d985fdcd1d688d29654a450.exe
Size

40KB
MD5

c344b7362d985fdcd1d688d29654a450
SHA1

a9c15dc17edc0ba7d1cd15efde97c00425f33266
SHA256

cfe8d0b1bb1ab8462a211773a1e8a701f1a921c077bb4b3aa6eab77afd1d434f
SHA512

4eabc82cc7a30db2e13a183f7cc228f5c645eb6d08036d83fe14745b1533c2537d89967c25eaf3fd10308d579f2ac4a1f141f68c00cfaf01c40a94a0b7fc8fc2
SSDEEP

768:kPN6nG3JitftDdNh/ROkMINjD+rT43v7wTiRS6TO7XG33C332M0fl+84WDMg3:VnGZiPDdVO3Ip+rczwGRVTOSHCH2dflr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2588	3044	WerFault.exe	27

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2588	3044	c344b7362d985fdcd1d688d29654a450.exe	28
PID 3044 wrote to memory of 2588	3044	c344b7362d985fdcd1d688d29654a450.exe	28
PID 3044 wrote to memory of 2588	3044	c344b7362d985fdcd1d688d29654a450.exe	28
PID 3044 wrote to memory of 2588	3044	c344b7362d985fdcd1d688d29654a450.exe	28
PID 3044 wrote to memory of 2588	3044	c344b7362d985fdcd1d688d29654a450.exe	28
PID 3044 wrote to memory of 2588	3044	c344b7362d985fdcd1d688d29654a450.exe	28
PID 3044 wrote to memory of 2588	3044	c344b7362d985fdcd1d688d29654a450.exe	28

C:\Users\Admin\AppData\Local\Temp\c344b7362d985fdcd1d688d29654a450.exe
"C:\Users\Admin\AppData\Local\Temp\c344b7362d985fdcd1d688d29654a450.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 324
  2⤵
  - Program crash
  PID:2588