cc1669cb87823a9b447896e14297c2d197a11703c4da4e7fff9af971bf7b965e

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06-07-2024 01:06

Target

cc1669cb87823a9b447896e14297c2d197a11703c4da4e7fff9af971bf7b965e.exe
Size

1.9MB
MD5

a5d151c329cbbe2f7e958eb161398915
SHA1

1be8fa6999c8b64b723121922a6f21a9a2dc4987
SHA256

cc1669cb87823a9b447896e14297c2d197a11703c4da4e7fff9af971bf7b965e
SHA512

53367a2761886bc44c007b8771d2633b776f27d40d9e2510b89799c7bfdaa35ee69e08895ee2598c508c2c758642d4958489cb40977a6df78ff40057bba8b2b8
SSDEEP

12288:ZqggE2Fepsks9ncJwYkw0LOLHjHd3KfWwNU17o126+X6R24hNxD27ffVuT8I42OE:G0sn9+gS6uHk1U4hzDiN1I42M0Sv2d

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2060 2196 WerFault.exe cc1669cb87823a9b447896e14297c2d197a11703c4da4e7fff9af971bf7b965e.exe

pid	pid_target	process	target process
2060	2196	WerFault.exe	cc1669cb87823a9b447896e14297c2d197a11703c4da4e7fff9af971bf7b965e.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cc1669cb87823a9b447896e14297c2d197a11703c4da4e7fff9af971bf7b965e.exe

description	pid	process	target process
PID 2196 wrote to memory of 2060	2196	cc1669cb87823a9b447896e14297c2d197a11703c4da4e7fff9af971bf7b965e.exe	WerFault.exe
PID 2196 wrote to memory of 2060	2196	cc1669cb87823a9b447896e14297c2d197a11703c4da4e7fff9af971bf7b965e.exe	WerFault.exe
PID 2196 wrote to memory of 2060	2196	cc1669cb87823a9b447896e14297c2d197a11703c4da4e7fff9af971bf7b965e.exe	WerFault.exe
PID 2196 wrote to memory of 2060	2196	cc1669cb87823a9b447896e14297c2d197a11703c4da4e7fff9af971bf7b965e.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\cc1669cb87823a9b447896e14297c2d197a11703c4da4e7fff9af971bf7b965e.exe
"C:\Users\Admin\AppData\Local\Temp\cc1669cb87823a9b447896e14297c2d197a11703c4da4e7fff9af971bf7b965e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 552
2⤵
- Program crash
PID:2060

memory/2196-0-0x000000007402E000-0x000000007402F000-memory.dmp

Filesize
4KB

Download
memory/2196-1-0x0000000001250000-0x0000000001440000-memory.dmp

Filesize
1.9MB

Download
memory/2196-2-0x000000007402E000-0x000000007402F000-memory.dmp

Filesize
4KB

Download