cebaa21a7812ef550d5adcc1a3b6c0e7e961d2192eccd5aba7838bbcb17b1da7

Analysis

max time kernel
239s
max time network
337s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 08:16

Target

cebaa21a7812ef550d5adcc1a3b6c0e7e961d2192eccd5aba7838bbcb17b1da7.exe
Size

115KB
MD5

4c55f6a3343674bf2108b45970672faa
SHA1

c55cc7a999bc360855755e81ca90b083f6c1fa73
SHA256

cebaa21a7812ef550d5adcc1a3b6c0e7e961d2192eccd5aba7838bbcb17b1da7
SHA512

568a4874d0a502f7fcccc5aade0955b7b1913ccbef106addfca4ffc1e9e48813a97d99b6c57e74091ee600580e6ef45f5b25a17880a383512792ae2e7717f546
SSDEEP

3072:A+wL8Lukb1jjU6w51PWFMp56Xp8Fsg93plK:A+wybG6w5sMf6Z8yg93pl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1712	472	WerFault.exe	24

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 472 wrote to memory of 1712	472	cebaa21a7812ef550d5adcc1a3b6c0e7e961d2192eccd5aba7838bbcb17b1da7.exe	28
PID 472 wrote to memory of 1712	472	cebaa21a7812ef550d5adcc1a3b6c0e7e961d2192eccd5aba7838bbcb17b1da7.exe	28
PID 472 wrote to memory of 1712	472	cebaa21a7812ef550d5adcc1a3b6c0e7e961d2192eccd5aba7838bbcb17b1da7.exe	28
PID 472 wrote to memory of 1712	472	cebaa21a7812ef550d5adcc1a3b6c0e7e961d2192eccd5aba7838bbcb17b1da7.exe	28

C:\Users\Admin\AppData\Local\Temp\cebaa21a7812ef550d5adcc1a3b6c0e7e961d2192eccd5aba7838bbcb17b1da7.exe
"C:\Users\Admin\AppData\Local\Temp\cebaa21a7812ef550d5adcc1a3b6c0e7e961d2192eccd5aba7838bbcb17b1da7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 472 -s 44
  2⤵
  - Program crash
  PID:1712