e3f33e98182424fb5e01661a30885309892916475e249d8a55366a1c59839680

Analysis

max time kernel
28s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-10-2022 18:13

Target

e3f33e98182424fb5e01661a30885309892916475e249d8a55366a1c59839680.exe
Size

116KB
MD5

63322ec5ae43348021d0ac3eba2472f0
SHA1

b7d7f5f69dd0256d30bb07d0a6a515bf2fad1595
SHA256

e3f33e98182424fb5e01661a30885309892916475e249d8a55366a1c59839680
SHA512

ef38064ee6b5e95db02a9767139bffa86458fca7f6152d589e49e67737e9bb67f88782784c9aaee238b827a66ce6af8c07036573f859d16977db4ea05c69d3c2
SSDEEP

3072:zewD9xZT2bagyitK7t//XZMSDADeak7dJHB/AC:ywrZT2br1tg/GSsQLH5AC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1560	1348	WerFault.exe	21

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 1560	1348	e3f33e98182424fb5e01661a30885309892916475e249d8a55366a1c59839680.exe	26
PID 1348 wrote to memory of 1560	1348	e3f33e98182424fb5e01661a30885309892916475e249d8a55366a1c59839680.exe	26
PID 1348 wrote to memory of 1560	1348	e3f33e98182424fb5e01661a30885309892916475e249d8a55366a1c59839680.exe	26
PID 1348 wrote to memory of 1560	1348	e3f33e98182424fb5e01661a30885309892916475e249d8a55366a1c59839680.exe	26

C:\Users\Admin\AppData\Local\Temp\e3f33e98182424fb5e01661a30885309892916475e249d8a55366a1c59839680.exe
"C:\Users\Admin\AppData\Local\Temp\e3f33e98182424fb5e01661a30885309892916475e249d8a55366a1c59839680.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 116
  2⤵
  - Program crash
  PID:1560

memory/1348-54-0x0000000074F41000-0x0000000074F43000-memory.dmp

Filesize
8KB

Download
memory/1348-56-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1560-55-0x0000000000000000-mapping.dmp

Download