ee38e42d8709ae737ebf2bfc5f7873660f8f93222bf574c20dcb4a63377a1c5e

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11-10-2022 03:48

Target

ee38e42d8709ae737ebf2bfc5f7873660f8f93222bf574c20dcb4a63377a1c5e.exe
Size

12KB
MD5

66eeb3989a8670247deaac8b3deb1b2b
SHA1

86b3d8f6a6c068ca32c68345ed3da4968f6fbfa6
SHA256

ee38e42d8709ae737ebf2bfc5f7873660f8f93222bf574c20dcb4a63377a1c5e
SHA512

005da2f4cee376e6dc89bfc3dc085ffa35215ae38f1cb720fd703d4091bdee56abdb6dc4448b7481497d29a0c5203b4398e272f4d95b06c569353de0c526a29a
SSDEEP

96:ckbkywvXgZ3agw/ZK322USxiKTWbonPtVPc5A71yQtQKQYQ:cKoy3ag2q22USxiH+P6A7MQjQYQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1220	1716	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 1220	1716	ee38e42d8709ae737ebf2bfc5f7873660f8f93222bf574c20dcb4a63377a1c5e.exe	27
PID 1716 wrote to memory of 1220	1716	ee38e42d8709ae737ebf2bfc5f7873660f8f93222bf574c20dcb4a63377a1c5e.exe	27
PID 1716 wrote to memory of 1220	1716	ee38e42d8709ae737ebf2bfc5f7873660f8f93222bf574c20dcb4a63377a1c5e.exe	27
PID 1716 wrote to memory of 1220	1716	ee38e42d8709ae737ebf2bfc5f7873660f8f93222bf574c20dcb4a63377a1c5e.exe	27

C:\Users\Admin\AppData\Local\Temp\ee38e42d8709ae737ebf2bfc5f7873660f8f93222bf574c20dcb4a63377a1c5e.exe
"C:\Users\Admin\AppData\Local\Temp\ee38e42d8709ae737ebf2bfc5f7873660f8f93222bf574c20dcb4a63377a1c5e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 88
  2⤵
  - Program crash
  PID:1220