2facae0316bb398d1895af1248d21cb3e88f83da4b8c0eeaef4f837d1bc98799

Analysis

max time kernel
118s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-03-2024 22:20

Target

c9c2ca31ac824ed5653a26d433d30e8e.exe
Size

208KB
MD5

c9c2ca31ac824ed5653a26d433d30e8e
SHA1

a8ed6c5f097e03ba9c5380b28e23b222ec882fe9
SHA256

2facae0316bb398d1895af1248d21cb3e88f83da4b8c0eeaef4f837d1bc98799
SHA512

743c495e8970670486f6fab76c0a28ac705e7dbd0043c29012e7f77b1926aad15c3e3989a29877bb3d1760c4b1e58ff2f8c05efa57898d3ba6c176fb9ef0dde0
SSDEEP

3072:BltUotXpzghxJ2Gb8epdi6e81o82p/JDuGIl+JKWMocftvX:ftmx3dN71n2p/JDuRl+JKWMP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2216	1704	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2216	1704	c9c2ca31ac824ed5653a26d433d30e8e.exe	28
PID 1704 wrote to memory of 2216	1704	c9c2ca31ac824ed5653a26d433d30e8e.exe	28
PID 1704 wrote to memory of 2216	1704	c9c2ca31ac824ed5653a26d433d30e8e.exe	28
PID 1704 wrote to memory of 2216	1704	c9c2ca31ac824ed5653a26d433d30e8e.exe	28

C:\Users\Admin\AppData\Local\Temp\c9c2ca31ac824ed5653a26d433d30e8e.exe
"C:\Users\Admin\AppData\Local\Temp\c9c2ca31ac824ed5653a26d433d30e8e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 44
  2⤵
  - Program crash
  PID:2216