fd99e95d43c5c343662ee7e7f3fd583e05e1198b123cffe18f285e6dee97f341

Analysis

max time kernel
2s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 20:27

Target

fd99e95d43c5c343662ee7e7f3fd583e05e1198b123cffe18f285e6dee97f341.exe
Size

10KB
MD5

ceca80f654e51f1a7fdc432765ae71c6
SHA1

3ec9f18ebea5f6f2112b9f9767ce0a0816d3a8f7
SHA256

fd99e95d43c5c343662ee7e7f3fd583e05e1198b123cffe18f285e6dee97f341
SHA512

06dcb1da04f5b80ff366ed98a75a58cf8b59a9ef796d9893203d7af4e083b7b6eea53e3739b0c7e9ee63dce6974cd49eec471564e8eefa8e9812923a3f8f555b
SSDEEP

192:npzV/5CntQcn0mGaB6mN16I+Xkck2yTfmYcqal:pz7stQc0ELN1X+Xkck1mYcqM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1608	1428	WerFault.exe	10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 1608	1428	fd99e95d43c5c343662ee7e7f3fd583e05e1198b123cffe18f285e6dee97f341.exe	28
PID 1428 wrote to memory of 1608	1428	fd99e95d43c5c343662ee7e7f3fd583e05e1198b123cffe18f285e6dee97f341.exe	28
PID 1428 wrote to memory of 1608	1428	fd99e95d43c5c343662ee7e7f3fd583e05e1198b123cffe18f285e6dee97f341.exe	28
PID 1428 wrote to memory of 1608	1428	fd99e95d43c5c343662ee7e7f3fd583e05e1198b123cffe18f285e6dee97f341.exe	28

C:\Users\Admin\AppData\Local\Temp\fd99e95d43c5c343662ee7e7f3fd583e05e1198b123cffe18f285e6dee97f341.exe
"C:\Users\Admin\AppData\Local\Temp\fd99e95d43c5c343662ee7e7f3fd583e05e1198b123cffe18f285e6dee97f341.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 44
  2⤵
  - Program crash
  PID:1608