ea3605f5420226cf33508a2b91aca641b1ba02d68aa49a6477c4ad3c7e0bb15f

Analysis

max time kernel
35s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 00:30

Target

ea3605f5420226cf33508a2b91aca641b1ba02d68aa49a6477c4ad3c7e0bb15f.exe
Size

42KB
MD5

008d5d8543d16911aeff2331c4c6c582
SHA1

6126cb5dd0ec2974357e71815a3536d62c126551
SHA256

ea3605f5420226cf33508a2b91aca641b1ba02d68aa49a6477c4ad3c7e0bb15f
SHA512

9546d124c67ccbc53a546c9341128356816a5aef55b6fdf53cb5099a6cb568de3074f24b34a6b69347eaba8aac75703ffd0b3800e5061b6b0b205b4279651075
SSDEEP

384:M6mIKeHBocMofgVf3ynjKXnQOIkswxo4Mcef2tLr8gdk:DJH8cjKBgQM1or52

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1632	1108	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 1632	1108	ea3605f5420226cf33508a2b91aca641b1ba02d68aa49a6477c4ad3c7e0bb15f.exe	27
PID 1108 wrote to memory of 1632	1108	ea3605f5420226cf33508a2b91aca641b1ba02d68aa49a6477c4ad3c7e0bb15f.exe	27
PID 1108 wrote to memory of 1632	1108	ea3605f5420226cf33508a2b91aca641b1ba02d68aa49a6477c4ad3c7e0bb15f.exe	27
PID 1108 wrote to memory of 1632	1108	ea3605f5420226cf33508a2b91aca641b1ba02d68aa49a6477c4ad3c7e0bb15f.exe	27

C:\Users\Admin\AppData\Local\Temp\ea3605f5420226cf33508a2b91aca641b1ba02d68aa49a6477c4ad3c7e0bb15f.exe
"C:\Users\Admin\AppData\Local\Temp\ea3605f5420226cf33508a2b91aca641b1ba02d68aa49a6477c4ad3c7e0bb15f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 36
  2⤵
  - Program crash
  PID:1632