19045a7919bce6dd3c7226aecee22fd425214008f34365aa22105c50c5063c8d

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 15:46

Target

c3bdefd89bd67588800cf750defa9882.exe
Size

56KB
MD5

c3bdefd89bd67588800cf750defa9882
SHA1

c27931cf0c5ee746ddebed5651c6525f12f961ad
SHA256

19045a7919bce6dd3c7226aecee22fd425214008f34365aa22105c50c5063c8d
SHA512

b796193886b3d58f62b4c16385000401c1798f792d6cccab0ac7b22c0dc0023357190d03ca6ffa2d775700618d051aec41340aeecf42e2ea1b2e2d8387beb409
SSDEEP

768:+A6B6xyqopMPAO6ChO2UHPQbzdFO8ttR+I9Ex8QdRNCR+:+A6BEyqk8+CZOy+2Ex8Qr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1936	2256	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 1936	2256	c3bdefd89bd67588800cf750defa9882.exe	28
PID 2256 wrote to memory of 1936	2256	c3bdefd89bd67588800cf750defa9882.exe	28
PID 2256 wrote to memory of 1936	2256	c3bdefd89bd67588800cf750defa9882.exe	28
PID 2256 wrote to memory of 1936	2256	c3bdefd89bd67588800cf750defa9882.exe	28

C:\Users\Admin\AppData\Local\Temp\c3bdefd89bd67588800cf750defa9882.exe
"C:\Users\Admin\AppData\Local\Temp\c3bdefd89bd67588800cf750defa9882.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 144
  2⤵
  - Program crash
  PID:1936

memory/2256-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2256-1-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download