fcf93ce4aaa45840be7dd57b5bbfc8c12f376ca7246721c52937276e72dd2745

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 09:28

Target

cdb2f7f11d89ab88c946a8d397e407fc.exe
Size

107KB
MD5

cdb2f7f11d89ab88c946a8d397e407fc
SHA1

1d297b6b99a50ea82940f483a928eba0102bf9f4
SHA256

fcf93ce4aaa45840be7dd57b5bbfc8c12f376ca7246721c52937276e72dd2745
SHA512

67b33dcc0236aa91b261a7999772f34339b2f2442aae13f40287033294a6b29d4aa399803f0507d95b05ff80556c8c372c74c633080254883be4327003f4a392
SSDEEP

3072:fBMzWD3JGi0DEtkbEriMzA8Vd42xfWcQ:pMw5+gtkYriMc8VdOcQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1908	1732	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1908	1732	cdb2f7f11d89ab88c946a8d397e407fc.exe	28
PID 1732 wrote to memory of 1908	1732	cdb2f7f11d89ab88c946a8d397e407fc.exe	28
PID 1732 wrote to memory of 1908	1732	cdb2f7f11d89ab88c946a8d397e407fc.exe	28
PID 1732 wrote to memory of 1908	1732	cdb2f7f11d89ab88c946a8d397e407fc.exe	28

C:\Users\Admin\AppData\Local\Temp\cdb2f7f11d89ab88c946a8d397e407fc.exe
"C:\Users\Admin\AppData\Local\Temp\cdb2f7f11d89ab88c946a8d397e407fc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 160
  2⤵
  - Program crash
  PID:1908

memory/1732-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1732-2-0x0000000000260000-0x0000000000290000-memory.dmp

Filesize
192KB

Download
memory/1732-1-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1732-3-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1732-4-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download