c0edf3e3c423792f0cefef1a786871ff79cefbb0d4ef1c7913ecbae6deced74a

Analysis

max time kernel
29s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 19:43

Target

c0edf3e3c423792f0cefef1a786871ff79cefbb0d4ef1c7913ecbae6deced74a.exe
Size

320KB
MD5

a0ca4a2d80eabc4f90e50ebfd46b6480
SHA1

3725f3ae4eb2848f321a86121e4a56f03093db5a
SHA256

c0edf3e3c423792f0cefef1a786871ff79cefbb0d4ef1c7913ecbae6deced74a
SHA512

ff13b3d4704a9998f0a3c79436d5319199a14909d68cd7b3e5b304f9b695d595cecd9e4b29cd858eb8bccc657ee48b4d2b6d8b34dad0f804f7d6b141470aa78a
SSDEEP

6144:fV/5mC3c5HWDKPH2RfS155ONNXBuWoJBO9OMbHLkAqF7Ief9UmM7/uT:f+5HmQ2EB0NxDIBuOFe7/uT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1116	748	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 1116	748	c0edf3e3c423792f0cefef1a786871ff79cefbb0d4ef1c7913ecbae6deced74a.exe	27
PID 748 wrote to memory of 1116	748	c0edf3e3c423792f0cefef1a786871ff79cefbb0d4ef1c7913ecbae6deced74a.exe	27
PID 748 wrote to memory of 1116	748	c0edf3e3c423792f0cefef1a786871ff79cefbb0d4ef1c7913ecbae6deced74a.exe	27
PID 748 wrote to memory of 1116	748	c0edf3e3c423792f0cefef1a786871ff79cefbb0d4ef1c7913ecbae6deced74a.exe	27

C:\Users\Admin\AppData\Local\Temp\c0edf3e3c423792f0cefef1a786871ff79cefbb0d4ef1c7913ecbae6deced74a.exe
"C:\Users\Admin\AppData\Local\Temp\c0edf3e3c423792f0cefef1a786871ff79cefbb0d4ef1c7913ecbae6deced74a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 36
  2⤵
  - Program crash
  PID:1116

memory/748-54-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download