13ea29b2122d6afd8d318949ffad38623a95ab682edc5a0e1ba033533a71a7e5

Analysis

max time kernel
44s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 14:11

Target

13ea29b2122d6afd8d318949ffad38623a95ab682edc5a0e1ba033533a71a7e5.exe
Size

250KB
MD5

6ee4f846bc93bd6f477ecbfa765bf33c
SHA1

6082d273ecfe8cd742c57357cdadfdfc9acfc80a
SHA256

13ea29b2122d6afd8d318949ffad38623a95ab682edc5a0e1ba033533a71a7e5
SHA512

cc5610103e08f6455fa77dde7443c5c5f8ec9bdc562960b4bc418afd96544b69e75239a59ac4d8e6b3d744c33c93b97abb96b115dd6a073c974805a1bef35e14
SSDEEP

1536:BTQVgd54vlVr43oQOdjcJIBkzQ54vJVr43oQOdjN:RL7q8fUjqkWmg8fUjN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1680	1372	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 1680	1372	13ea29b2122d6afd8d318949ffad38623a95ab682edc5a0e1ba033533a71a7e5.exe	28
PID 1372 wrote to memory of 1680	1372	13ea29b2122d6afd8d318949ffad38623a95ab682edc5a0e1ba033533a71a7e5.exe	28
PID 1372 wrote to memory of 1680	1372	13ea29b2122d6afd8d318949ffad38623a95ab682edc5a0e1ba033533a71a7e5.exe	28
PID 1372 wrote to memory of 1680	1372	13ea29b2122d6afd8d318949ffad38623a95ab682edc5a0e1ba033533a71a7e5.exe	28

C:\Users\Admin\AppData\Local\Temp\13ea29b2122d6afd8d318949ffad38623a95ab682edc5a0e1ba033533a71a7e5.exe
"C:\Users\Admin\AppData\Local\Temp\13ea29b2122d6afd8d318949ffad38623a95ab682edc5a0e1ba033533a71a7e5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 148
  2⤵
  - Program crash
  PID:1680

memory/1372-55-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download