eb4491162f4c6fa0940fa3b7229b8bfa5816bae96f0038ef18dfdf903d2f925b

Analysis

max time kernel
34s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/10/2022, 21:39

Target

eb4491162f4c6fa0940fa3b7229b8bfa5816bae96f0038ef18dfdf903d2f925b.exe
Size

56KB
MD5

6f42a6f9a29234515695142931914af8
SHA1

5c825a1795119dbad1126222558e93b496202e36
SHA256

eb4491162f4c6fa0940fa3b7229b8bfa5816bae96f0038ef18dfdf903d2f925b
SHA512

511e7839a7d648c3112d0b32f18493b9c70db88b41f10673d9badb3a8648a58e2a2a1ef05e9eb5ddf8ac06124ea02e8f887429bb3595be7e089f351a40dc2670
SSDEEP

1536:6UaNWA2kGd0lHU+umoC4zRVkQApi6bNnY7GsvdJL63Z:5aNWA2xWlthoh9VVF6bNYRdM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1744	1384	WerFault.exe	9

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 1744	1384	eb4491162f4c6fa0940fa3b7229b8bfa5816bae96f0038ef18dfdf903d2f925b.exe	28
PID 1384 wrote to memory of 1744	1384	eb4491162f4c6fa0940fa3b7229b8bfa5816bae96f0038ef18dfdf903d2f925b.exe	28
PID 1384 wrote to memory of 1744	1384	eb4491162f4c6fa0940fa3b7229b8bfa5816bae96f0038ef18dfdf903d2f925b.exe	28
PID 1384 wrote to memory of 1744	1384	eb4491162f4c6fa0940fa3b7229b8bfa5816bae96f0038ef18dfdf903d2f925b.exe	28

C:\Users\Admin\AppData\Local\Temp\eb4491162f4c6fa0940fa3b7229b8bfa5816bae96f0038ef18dfdf903d2f925b.exe
"C:\Users\Admin\AppData\Local\Temp\eb4491162f4c6fa0940fa3b7229b8bfa5816bae96f0038ef18dfdf903d2f925b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 36
  2⤵
  - Program crash
  PID:1744