36a33e7da8ad27ce449d6bc53c6ca650bc283b8f96d5fe797187aea40e0dcc68

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 05:30

Target

c0c8fc8c3baf26ce045fa13a8b1bf6d6051171f13321183317fc587bd5217e49.exe
Size

976KB
MD5

6d001bfef69bd5ba214890560410dfb3
SHA1

61ecf49a6d2e3aee64704e53386f8bf2587d2b01
SHA256

c0c8fc8c3baf26ce045fa13a8b1bf6d6051171f13321183317fc587bd5217e49
SHA512

2e83fd72e0c2f3cae79066f135c88f70af09375761c73b00c617b2ef10b9011609ed4732fd068818995cc14d0bdbd2c323dea968631b06558141a1a048729486
SSDEEP

12288:LDSmk3QSIvpbmlbqYfMG7k+ezHvyOWUtggrafGeZleuzYrA5nOkNFR65a:eXIvpbmUYfMG7M/LtggrypVlR

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

804 2356 WerFault.exe c0c8fc8c3baf26ce045fa13a8b1bf6d6051171f13321183317fc587bd5217e49.exe

pid	pid_target	process	target process
804	2356	WerFault.exe	c0c8fc8c3baf26ce045fa13a8b1bf6d6051171f13321183317fc587bd5217e49.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c0c8fc8c3baf26ce045fa13a8b1bf6d6051171f13321183317fc587bd5217e49.exe

description	pid	process	target process
PID 2356 wrote to memory of 804	2356	c0c8fc8c3baf26ce045fa13a8b1bf6d6051171f13321183317fc587bd5217e49.exe	WerFault.exe
PID 2356 wrote to memory of 804	2356	c0c8fc8c3baf26ce045fa13a8b1bf6d6051171f13321183317fc587bd5217e49.exe	WerFault.exe
PID 2356 wrote to memory of 804	2356	c0c8fc8c3baf26ce045fa13a8b1bf6d6051171f13321183317fc587bd5217e49.exe	WerFault.exe
PID 2356 wrote to memory of 804	2356	c0c8fc8c3baf26ce045fa13a8b1bf6d6051171f13321183317fc587bd5217e49.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c0c8fc8c3baf26ce045fa13a8b1bf6d6051171f13321183317fc587bd5217e49.exe
"C:\Users\Admin\AppData\Local\Temp\c0c8fc8c3baf26ce045fa13a8b1bf6d6051171f13321183317fc587bd5217e49.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 52
  2⤵
  - Program crash
  PID:804

memory/2356-0-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/2356-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download