cebaa21a7812ef550d5adcc1a3b6c0e7e961d2192eccd5aba7838bbcb17b1da7

Analysis

max time kernel
255s
max time network
273s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 08:16

Target

cebaa21a7812ef550d5adcc1a3b6c0e7e961d2192eccd5aba7838bbcb17b1da7.exe
Size

115KB
MD5

4c55f6a3343674bf2108b45970672faa
SHA1

c55cc7a999bc360855755e81ca90b083f6c1fa73
SHA256

cebaa21a7812ef550d5adcc1a3b6c0e7e961d2192eccd5aba7838bbcb17b1da7
SHA512

568a4874d0a502f7fcccc5aade0955b7b1913ccbef106addfca4ffc1e9e48813a97d99b6c57e74091ee600580e6ef45f5b25a17880a383512792ae2e7717f546
SSDEEP

3072:A+wL8Lukb1jjU6w51PWFMp56Xp8Fsg93plK:A+wybG6w5sMf6Z8yg93pl

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
656	1968	WerFault.exe	78
2868	1968	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 656	1968	cebaa21a7812ef550d5adcc1a3b6c0e7e961d2192eccd5aba7838bbcb17b1da7.exe	80
PID 1968 wrote to memory of 656	1968	cebaa21a7812ef550d5adcc1a3b6c0e7e961d2192eccd5aba7838bbcb17b1da7.exe	80
PID 1968 wrote to memory of 656	1968	cebaa21a7812ef550d5adcc1a3b6c0e7e961d2192eccd5aba7838bbcb17b1da7.exe	80

C:\Users\Admin\AppData\Local\Temp\cebaa21a7812ef550d5adcc1a3b6c0e7e961d2192eccd5aba7838bbcb17b1da7.exe
"C:\Users\Admin\AppData\Local\Temp\cebaa21a7812ef550d5adcc1a3b6c0e7e961d2192eccd5aba7838bbcb17b1da7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 228
  2⤵
  - Program crash
  PID:656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 228
  2⤵
  - Program crash
  PID:2868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1968 -ip 1968
1⤵
PID:1672