ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61

Resubmissions

17/05/2024, 23:39

31/03/2024, 18:02

31/03/2024, 17:58

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31/03/2024, 17:58

Target
ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe
Size 754KB
Sample240331-wkbrragc21
SHA256 ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61
MD5 f1fdda86a94e2d1abbd244089d73752f
SHA1 70f8defd6b861717142d7db8a1fe2be6a34a5b13
SHA512 6a4fb99c397b55a61be466f52a83dd9fade0e022f5cd3cdb18411069cea6b0f2ae85f980555e62b710955ce1083ed11377c2bcce495f6a6012dd3e2b4325f18c
SSDEEP 6144:VQM3xHba9C4q/HVF7eHpnTHzJEWyLBMRJDL+gpFfD2l9pAZcXXkqD:V3x7a9a8HdPjX+gpFfDO0+XX
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1612	1220	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 1612	1220	ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe	28
PID 1220 wrote to memory of 1612	1220	ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe	28
PID 1220 wrote to memory of 1612	1220	ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe	28
PID 1220 wrote to memory of 1612	1220	ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe	28

C:\Users\Admin\AppData\Local\Temp\ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe
"C:\Users\Admin\AppData\Local\Temp\ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 120
  2⤵
  - Program crash
  PID:1612

memory/1220-0-0x0000000000400000-0x00000000004BE000-memory.dmp

Download