de0fbf2c08a064b8c9e756f107556bd5e0d14c08efdc2baba76316592f954eb8

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/11/2022, 13:20

Target

de0fbf2c08a064b8c9e756f107556bd5e0d14c08efdc2baba76316592f954eb8.exe
Size

155KB
MD5

a5f8ee4981fbac34f9da078e5e0d52d2
SHA1

ae412c873cb61e89b378df5032fc69cb1a422ee6
SHA256

de0fbf2c08a064b8c9e756f107556bd5e0d14c08efdc2baba76316592f954eb8
SHA512

ed39ac40ab465e85a0a5645031f3a3c75dcccc7aa99f0294df6eee08a163f36c9013e8c012e754bd9a0237d22cb4bd8f49b803cd5c4f9e7300104a5ea670e7de
SSDEEP

3072:l5K/B0toLQSNJ1lZHQsozTS+SMqqDL2/TrKpHG:lcytwtz1yTS+xqqDL6HKM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1496	1468	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 1496	1468	de0fbf2c08a064b8c9e756f107556bd5e0d14c08efdc2baba76316592f954eb8.exe	27
PID 1468 wrote to memory of 1496	1468	de0fbf2c08a064b8c9e756f107556bd5e0d14c08efdc2baba76316592f954eb8.exe	27
PID 1468 wrote to memory of 1496	1468	de0fbf2c08a064b8c9e756f107556bd5e0d14c08efdc2baba76316592f954eb8.exe	27
PID 1468 wrote to memory of 1496	1468	de0fbf2c08a064b8c9e756f107556bd5e0d14c08efdc2baba76316592f954eb8.exe	27

C:\Users\Admin\AppData\Local\Temp\de0fbf2c08a064b8c9e756f107556bd5e0d14c08efdc2baba76316592f954eb8.exe
"C:\Users\Admin\AppData\Local\Temp\de0fbf2c08a064b8c9e756f107556bd5e0d14c08efdc2baba76316592f954eb8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 88
  2⤵
  - Program crash
  PID:1496