ceedf4217fb7d200487e6eff83b93e5fe7226cc3911bf49391eca833b55962e6

Analysis

max time kernel
42s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 04:32

Target

ceedf4217fb7d200487e6eff83b93e5fe7226cc3911bf49391eca833b55962e6.exe
Size

259KB
MD5

21af5cbbd7738593070be69a8c97555d
SHA1

b754b40c3ce73cd2dcc01fbc80d0d8198906f726
SHA256

ceedf4217fb7d200487e6eff83b93e5fe7226cc3911bf49391eca833b55962e6
SHA512

56034c5739b33df5e68f8869d588dc60de34493eb520e238ad68df00b6436e77058e4ebe4fdf9a76da6b1e307c9509b65da705bdf24b667b03ac4258975d279d
SSDEEP

3072:jnnAQVG/LytaKItS/fiLKS+f5Aq7i6z9j+7FFIQPvjf8KZkZ9+kMLPjkOXIZaT:TOTeHI8HiL7+f57qIOvjf8KZmMIOXDT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
876	288	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 288 wrote to memory of 876	288	ceedf4217fb7d200487e6eff83b93e5fe7226cc3911bf49391eca833b55962e6.exe	28
PID 288 wrote to memory of 876	288	ceedf4217fb7d200487e6eff83b93e5fe7226cc3911bf49391eca833b55962e6.exe	28
PID 288 wrote to memory of 876	288	ceedf4217fb7d200487e6eff83b93e5fe7226cc3911bf49391eca833b55962e6.exe	28
PID 288 wrote to memory of 876	288	ceedf4217fb7d200487e6eff83b93e5fe7226cc3911bf49391eca833b55962e6.exe	28

C:\Users\Admin\AppData\Local\Temp\ceedf4217fb7d200487e6eff83b93e5fe7226cc3911bf49391eca833b55962e6.exe
"C:\Users\Admin\AppData\Local\Temp\ceedf4217fb7d200487e6eff83b93e5fe7226cc3911bf49391eca833b55962e6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 288 -s 172
  2⤵
  - Program crash
  PID:876

memory/288-54-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/288-56-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download