adefbe03923f459e45f7075943aa49e13a30e8533ec6aaaa9f22feee4d2d237c

Analysis

max time kernel
28s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 09:39

Target

adefbe03923f459e45f7075943aa49e13a30e8533ec6aaaa9f22feee4d2d237c.exe
Size

76KB
MD5

aec4a1f89669ab2538100708a4d0f713
SHA1

158aaf2accc660f68cbf486bd0968846944db552
SHA256

adefbe03923f459e45f7075943aa49e13a30e8533ec6aaaa9f22feee4d2d237c
SHA512

6436c1373d9286e4d64a5213713643a051ca4b619e21b617d065ed4276e8df01399558b5cac2712b3fcb31d12e09b0d41405fd1926c9c03ec488485b2e8d20d5
SSDEEP

1536:vdXqH+OTl3d2YpxOmVU5BFv+OkgUmukJjDVYApjVrs2ryrd1vUQuq6:vdcHM/BFv+OzUOhCAHs2qo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1332	1236	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 1332	1236	adefbe03923f459e45f7075943aa49e13a30e8533ec6aaaa9f22feee4d2d237c.exe	28
PID 1236 wrote to memory of 1332	1236	adefbe03923f459e45f7075943aa49e13a30e8533ec6aaaa9f22feee4d2d237c.exe	28
PID 1236 wrote to memory of 1332	1236	adefbe03923f459e45f7075943aa49e13a30e8533ec6aaaa9f22feee4d2d237c.exe	28
PID 1236 wrote to memory of 1332	1236	adefbe03923f459e45f7075943aa49e13a30e8533ec6aaaa9f22feee4d2d237c.exe	28

C:\Users\Admin\AppData\Local\Temp\adefbe03923f459e45f7075943aa49e13a30e8533ec6aaaa9f22feee4d2d237c.exe
"C:\Users\Admin\AppData\Local\Temp\adefbe03923f459e45f7075943aa49e13a30e8533ec6aaaa9f22feee4d2d237c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 36
  2⤵
  - Program crash
  PID:1332

memory/1236-55-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download