daad702bcedcb79a04cd61d119e243d5d59783e51162210c89965c106d025aad

Analysis

max time kernel
37s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:20

Target

daad702bcedcb79a04cd61d119e243d5d59783e51162210c89965c106d025aad.exe
Size

56KB
MD5

39b6e380a215bbd0a8fc0a7ad32c0579
SHA1

3e49f87e7b210d6586462ad80dfbcb844b13926b
SHA256

daad702bcedcb79a04cd61d119e243d5d59783e51162210c89965c106d025aad
SHA512

2ab55ea47d13a032fd254fd174ebcea6934dbb34970b838c67d5618edefd582c58a3917e7e2e6643f43e0e21481afad1d9d6b184fe55360146026db639a6d5dc
SSDEEP

1536:coL14x0XszlCH6I/aoQOVYYIDCwWbEo9PU7TGU5baqgIB:6x1zwioJ0xo9W3laqgIB

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1484 1956 WerFault.exe daad702bcedcb79a04cd61d119e243d5d59783e51162210c89965c106d025aad.exe

pid	pid_target	process	target process
1484	1956	WerFault.exe	daad702bcedcb79a04cd61d119e243d5d59783e51162210c89965c106d025aad.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

daad702bcedcb79a04cd61d119e243d5d59783e51162210c89965c106d025aad.exe

description	pid	process	target process
PID 1956 wrote to memory of 1484	1956	daad702bcedcb79a04cd61d119e243d5d59783e51162210c89965c106d025aad.exe	WerFault.exe
PID 1956 wrote to memory of 1484	1956	daad702bcedcb79a04cd61d119e243d5d59783e51162210c89965c106d025aad.exe	WerFault.exe
PID 1956 wrote to memory of 1484	1956	daad702bcedcb79a04cd61d119e243d5d59783e51162210c89965c106d025aad.exe	WerFault.exe
PID 1956 wrote to memory of 1484	1956	daad702bcedcb79a04cd61d119e243d5d59783e51162210c89965c106d025aad.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\daad702bcedcb79a04cd61d119e243d5d59783e51162210c89965c106d025aad.exe
"C:\Users\Admin\AppData\Local\Temp\daad702bcedcb79a04cd61d119e243d5d59783e51162210c89965c106d025aad.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 36
2⤵
- Program crash
PID:1484