0dfeda2160243f03e92b6a1a5f28f56cebad0a878b9204fcfc79349378b3ab8d

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-01-2024 23:35

Target

0dfeda2160243f03e92b6a1a5f28f56cebad0a878b9204fcfc79349378b3ab8d.exe
Size

5KB
MD5

0eff9783a4bd3189213e1d7324315c78
SHA1

1399ff25a9b3d172175a6d8c0a20e829720b460b
SHA256

0dfeda2160243f03e92b6a1a5f28f56cebad0a878b9204fcfc79349378b3ab8d
SHA512

ac7030b7e1ba6c607c4b8538103baad73d6e62fee970725c6e0c5ef741bbabfbaa5ce3460bf78acba3051da3cb913f84e5a32b8be59e48239c961a2d54a97c8e
SSDEEP

48:S6ilXWFPpT+dXVfzZh4yMGcKzMEkTaak4PAZivO2pB42pBdvMZL2R7tLRuqSxp:eWLkFfNnOKYloIQ2pm2pbYSZxE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1708	1984	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 1708	1984	0dfeda2160243f03e92b6a1a5f28f56cebad0a878b9204fcfc79349378b3ab8d.exe	28
PID 1984 wrote to memory of 1708	1984	0dfeda2160243f03e92b6a1a5f28f56cebad0a878b9204fcfc79349378b3ab8d.exe	28
PID 1984 wrote to memory of 1708	1984	0dfeda2160243f03e92b6a1a5f28f56cebad0a878b9204fcfc79349378b3ab8d.exe	28
PID 1984 wrote to memory of 1708	1984	0dfeda2160243f03e92b6a1a5f28f56cebad0a878b9204fcfc79349378b3ab8d.exe	28

C:\Users\Admin\AppData\Local\Temp\0dfeda2160243f03e92b6a1a5f28f56cebad0a878b9204fcfc79349378b3ab8d.exe
"C:\Users\Admin\AppData\Local\Temp\0dfeda2160243f03e92b6a1a5f28f56cebad0a878b9204fcfc79349378b3ab8d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 48
  2⤵
  - Program crash
  PID:1708