cda9310715b7a12f47b7c134260d5ff9200c147fc1d05f030e507e57e3582327

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-04-2024 14:12

Target

cda9310715b7a12f47b7c134260d5ff9200c147fc1d05f030e507e57e3582327.exe
Size

624KB
MD5

9ec8468dd4a81b0b35c499b31e67375e
SHA1

6fa04992c0624c7aa3ca80da6a30e6de91226a16
SHA256

cda9310715b7a12f47b7c134260d5ff9200c147fc1d05f030e507e57e3582327
SHA512

bd6b37a0395f0ae508c54dcb62d5258adfb8c202605db8310c6b8758c3874bd2364491b1b129209ba1854df27f35149f891ac785a89fe26ddc45c40cad8023b2
SSDEEP

12288:CpCB9AVqhPDUHvOdO21ai1m2Y+o1mQR5LaVfnkBUxarLIN8Wah5/wodPdv7PVTFe:Cp12UPQkBUO/B5/lzTVTFH+

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2848 2884 WerFault.exe cda9310715b7a12f47b7c134260d5ff9200c147fc1d05f030e507e57e3582327.exe

pid	pid_target	process	target process
2848	2884	WerFault.exe	cda9310715b7a12f47b7c134260d5ff9200c147fc1d05f030e507e57e3582327.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cda9310715b7a12f47b7c134260d5ff9200c147fc1d05f030e507e57e3582327.exe

description	pid	process	target process
PID 2884 wrote to memory of 2848	2884	cda9310715b7a12f47b7c134260d5ff9200c147fc1d05f030e507e57e3582327.exe	WerFault.exe
PID 2884 wrote to memory of 2848	2884	cda9310715b7a12f47b7c134260d5ff9200c147fc1d05f030e507e57e3582327.exe	WerFault.exe
PID 2884 wrote to memory of 2848	2884	cda9310715b7a12f47b7c134260d5ff9200c147fc1d05f030e507e57e3582327.exe	WerFault.exe
PID 2884 wrote to memory of 2848	2884	cda9310715b7a12f47b7c134260d5ff9200c147fc1d05f030e507e57e3582327.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\cda9310715b7a12f47b7c134260d5ff9200c147fc1d05f030e507e57e3582327.exe
"C:\Users\Admin\AppData\Local\Temp\cda9310715b7a12f47b7c134260d5ff9200c147fc1d05f030e507e57e3582327.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 156
  2⤵
  - Program crash
  PID:2848