2ebbf6b3ca5734c54e6882071683f5406a3977796e006748863a3081ba5d740b

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 09:02

Target

2ebbf6b3ca5734c54e6882071683f5406a3977796e006748863a3081ba5d740b.exe
Size

128KB
MD5

fad28cfc4aa5ec2163094e2b7719bd9d
SHA1

48a3af7c9587b170bb98fa39fce34d4252fb878a
SHA256

2ebbf6b3ca5734c54e6882071683f5406a3977796e006748863a3081ba5d740b
SHA512

8181064a43030eb19509dbb24ea60d2b809067ce7d46af5692ce5decd73452a0a86de5601d888e7384b8ec5d02e18590b68369ba01eda3cd075646115b7b3968
SSDEEP

3072:fH3+b3v+n7MDXn7tX49ZsZgYsIGY18gS7ChSr5fI+QK/:P3+bf+WXn7tX4+nrGYWfOhi/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1516	1708	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1516	1708	2ebbf6b3ca5734c54e6882071683f5406a3977796e006748863a3081ba5d740b.exe	27
PID 1708 wrote to memory of 1516	1708	2ebbf6b3ca5734c54e6882071683f5406a3977796e006748863a3081ba5d740b.exe	27
PID 1708 wrote to memory of 1516	1708	2ebbf6b3ca5734c54e6882071683f5406a3977796e006748863a3081ba5d740b.exe	27
PID 1708 wrote to memory of 1516	1708	2ebbf6b3ca5734c54e6882071683f5406a3977796e006748863a3081ba5d740b.exe	27

C:\Users\Admin\AppData\Local\Temp\2ebbf6b3ca5734c54e6882071683f5406a3977796e006748863a3081ba5d740b.exe
"C:\Users\Admin\AppData\Local\Temp\2ebbf6b3ca5734c54e6882071683f5406a3977796e006748863a3081ba5d740b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 36
  2⤵
  - Program crash
  PID:1516

memory/1708-55-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download