cedfcdec78aeb64e1545109d367342a25af2b4d2e8f3f562f6a0aa9939cee8c7

Analysis

max time kernel
144s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 23:47

Target

cedfcdec78aeb64e1545109d367342a25af2b4d2e8f3f562f6a0aa9939cee8c7.exe
Size

31KB
MD5

343515181ed30e9014ed5745061b1979
SHA1

c7cdf04f5903e7824c3d90b8ea18598f17c30347
SHA256

cedfcdec78aeb64e1545109d367342a25af2b4d2e8f3f562f6a0aa9939cee8c7
SHA512

ed00210dc762fd419838b94b46a99cdfa86f4efd9c7274f7d364c6089f0ff254a2260750eb5b5a5f20366e98cf3d30cbb3195034f24bdd52fc4106c4aa48a4c0
SSDEEP

768:Zmh7TzTBGixfTeiZSVW7hwEkns0L7OTLNfufC3:sZ5cEks8OTBx

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1548 1468 WerFault.exe cedfcdec78aeb64e1545109d367342a25af2b4d2e8f3f562f6a0aa9939cee8c7.exe

pid	pid_target	process	target process
1548	1468	WerFault.exe	cedfcdec78aeb64e1545109d367342a25af2b4d2e8f3f562f6a0aa9939cee8c7.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cedfcdec78aeb64e1545109d367342a25af2b4d2e8f3f562f6a0aa9939cee8c7.exe

description	pid	process	target process
PID 1468 wrote to memory of 1548	1468	cedfcdec78aeb64e1545109d367342a25af2b4d2e8f3f562f6a0aa9939cee8c7.exe	WerFault.exe
PID 1468 wrote to memory of 1548	1468	cedfcdec78aeb64e1545109d367342a25af2b4d2e8f3f562f6a0aa9939cee8c7.exe	WerFault.exe
PID 1468 wrote to memory of 1548	1468	cedfcdec78aeb64e1545109d367342a25af2b4d2e8f3f562f6a0aa9939cee8c7.exe	WerFault.exe
PID 1468 wrote to memory of 1548	1468	cedfcdec78aeb64e1545109d367342a25af2b4d2e8f3f562f6a0aa9939cee8c7.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\cedfcdec78aeb64e1545109d367342a25af2b4d2e8f3f562f6a0aa9939cee8c7.exe
"C:\Users\Admin\AppData\Local\Temp\cedfcdec78aeb64e1545109d367342a25af2b4d2e8f3f562f6a0aa9939cee8c7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 96
2⤵
- Program crash
PID:1548

memory/1468-54-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1468-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1548-55-0x0000000000000000-mapping.dmp

Download