bedda74dd3de9595acc801dfbb50c3392688ce469064f8c655b306d15b29c1fa

Analysis

max time kernel
6s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 05:23

Target

bedda74dd3de9595acc801dfbb50c3392688ce469064f8c655b306d15b29c1fa.exe
Size

234KB
MD5

0068595ab0b343d019917cf605ec4e0b
SHA1

9e63ca71dd1eff343921bf60b2a325bae0fb84c2
SHA256

bedda74dd3de9595acc801dfbb50c3392688ce469064f8c655b306d15b29c1fa
SHA512

7c59059d1f683260eea1106cb1abde082e4d4d578eabcee802c26e281c3ac167cb54c17bb0400247adbba8d88b0cc9cabcb2f97d532c37f909641c3670d267e3
SSDEEP

6144:EYasXi/UScwJietVRj1J7m3txRs5+V11f:Ssy3IetVRf7m3t0+V1N

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1248	1356	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 1248	1356	bedda74dd3de9595acc801dfbb50c3392688ce469064f8c655b306d15b29c1fa.exe	28
PID 1356 wrote to memory of 1248	1356	bedda74dd3de9595acc801dfbb50c3392688ce469064f8c655b306d15b29c1fa.exe	28
PID 1356 wrote to memory of 1248	1356	bedda74dd3de9595acc801dfbb50c3392688ce469064f8c655b306d15b29c1fa.exe	28
PID 1356 wrote to memory of 1248	1356	bedda74dd3de9595acc801dfbb50c3392688ce469064f8c655b306d15b29c1fa.exe	28

C:\Users\Admin\AppData\Local\Temp\bedda74dd3de9595acc801dfbb50c3392688ce469064f8c655b306d15b29c1fa.exe
"C:\Users\Admin\AppData\Local\Temp\bedda74dd3de9595acc801dfbb50c3392688ce469064f8c655b306d15b29c1fa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 68
  2⤵
  - Program crash
  PID:1248