57e780bedb10d512f80e5324291077fd413d2206c9fe4f2588a6495bede5f939

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 15:27

Target

cbc31e996c6ea1d72fa5fddc9ee176d5.exe
Size

637KB
MD5

cbc31e996c6ea1d72fa5fddc9ee176d5
SHA1

4d14bd6a2d3244419ed2cc20be80bdbce2615c6a
SHA256

57e780bedb10d512f80e5324291077fd413d2206c9fe4f2588a6495bede5f939
SHA512

6547f71f84616fa44f07672f38cb216449a513d7a6f475589f276c1012c450070f244eee2fc677fe03335fce19f2e0dfdb404f41569156c3dd0ef6ca09bff172
SSDEEP

12288:rrFHeqVPUQaUaVA5rUTN6ftZKih58E4BI4R7Kv+ytwKTM39eKmuhaSEqFZe:rrBe+cQaUprUdM8JBjQv+yaKOetuMbqS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2104	1888	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2104	1888	cbc31e996c6ea1d72fa5fddc9ee176d5.exe	28
PID 1888 wrote to memory of 2104	1888	cbc31e996c6ea1d72fa5fddc9ee176d5.exe	28
PID 1888 wrote to memory of 2104	1888	cbc31e996c6ea1d72fa5fddc9ee176d5.exe	28
PID 1888 wrote to memory of 2104	1888	cbc31e996c6ea1d72fa5fddc9ee176d5.exe	28

C:\Users\Admin\AppData\Local\Temp\cbc31e996c6ea1d72fa5fddc9ee176d5.exe
"C:\Users\Admin\AppData\Local\Temp\cbc31e996c6ea1d72fa5fddc9ee176d5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 128
  2⤵
  - Program crash
  PID:2104

memory/1888-0-0x0000000000220000-0x0000000000232000-memory.dmp

Filesize
72KB

Download
memory/1888-1-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download