cd5b4ae411dec255f6b3a1444012f21ec1a76b3a1ce5e837a06267426c909b5d

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 15:10

Target

cd5b4ae411dec255f6b3a1444012f21ec1a76b3a1ce5e837a06267426c909b5d.exe
Size

80KB
MD5

1ece3fed96e5f30387334d6304fc8219
SHA1

9ec4b3ea43b94f48d6624bc5721a77cbb8500841
SHA256

cd5b4ae411dec255f6b3a1444012f21ec1a76b3a1ce5e837a06267426c909b5d
SHA512

4b7f19d63ddc83c71b66b3f285d836f0f52ff46d408e19d0fc18aed843c39d82e543ee0d3c6f6e7ba9506b5b8730509ddd071c6e690f674e957deebe0d024de6
SSDEEP

1536:vXcxhhFpEU/lkwYBSvZrHHHHHHHaHHHH4yoEQwLgZ6rPYZrFTRJOpoXZ:vcxD/iB+ZrHHHHHHHaHHHHSeg4bYZp1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1712	1688	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1712	1688	cd5b4ae411dec255f6b3a1444012f21ec1a76b3a1ce5e837a06267426c909b5d.exe	28
PID 1688 wrote to memory of 1712	1688	cd5b4ae411dec255f6b3a1444012f21ec1a76b3a1ce5e837a06267426c909b5d.exe	28
PID 1688 wrote to memory of 1712	1688	cd5b4ae411dec255f6b3a1444012f21ec1a76b3a1ce5e837a06267426c909b5d.exe	28
PID 1688 wrote to memory of 1712	1688	cd5b4ae411dec255f6b3a1444012f21ec1a76b3a1ce5e837a06267426c909b5d.exe	28

C:\Users\Admin\AppData\Local\Temp\cd5b4ae411dec255f6b3a1444012f21ec1a76b3a1ce5e837a06267426c909b5d.exe
"C:\Users\Admin\AppData\Local\Temp\cd5b4ae411dec255f6b3a1444012f21ec1a76b3a1ce5e837a06267426c909b5d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 36
  2⤵
  - Program crash
  PID:1712