fdefa2fd39f7f6d4412feccb13c06151f73f221549b4fa575ac1e4f6beab7545

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 02:26

Target

fdefa2fd39f7f6d4412feccb13c06151f73f221549b4fa575ac1e4f6beab7545.exe
Size

116KB
MD5

a2c7aaaae0253c186670e6678e653d79
SHA1

c0ac19e51ae70cc3f200c2c43f83854073fe1790
SHA256

fdefa2fd39f7f6d4412feccb13c06151f73f221549b4fa575ac1e4f6beab7545
SHA512

7f1abfd97f7afef41feed555cd33dd2fa04dac415a2e38a2379de31a3081f9e555a8bd0beb62477e8dc8e63fbd05f3100b57cf9737aae5b531729b3c115971fc
SSDEEP

1536:yaPXjBEHHpielpzWW4mCEzFI2aQx6GvT:/PX5elpzGmCS5xx6Y

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
956	2016	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 956	2016	fdefa2fd39f7f6d4412feccb13c06151f73f221549b4fa575ac1e4f6beab7545.exe	27
PID 2016 wrote to memory of 956	2016	fdefa2fd39f7f6d4412feccb13c06151f73f221549b4fa575ac1e4f6beab7545.exe	27
PID 2016 wrote to memory of 956	2016	fdefa2fd39f7f6d4412feccb13c06151f73f221549b4fa575ac1e4f6beab7545.exe	27
PID 2016 wrote to memory of 956	2016	fdefa2fd39f7f6d4412feccb13c06151f73f221549b4fa575ac1e4f6beab7545.exe	27

C:\Users\Admin\AppData\Local\Temp\fdefa2fd39f7f6d4412feccb13c06151f73f221549b4fa575ac1e4f6beab7545.exe
"C:\Users\Admin\AppData\Local\Temp\fdefa2fd39f7f6d4412feccb13c06151f73f221549b4fa575ac1e4f6beab7545.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 48
  2⤵
  - Program crash
  PID:956