e69fddbd89918c6e9bb6179fd4627987cb493d0a6fa08c66a28824e26e0f7568

Analysis

max time kernel
36s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12/10/2022, 14:02

Target

e69fddbd89918c6e9bb6179fd4627987cb493d0a6fa08c66a28824e26e0f7568.exe
Size

224KB
MD5

78eb53b51f52d8079b5b40bb921e3ae0
SHA1

b8bd985b53bd80be059b5a0c87b49bee4e861c92
SHA256

e69fddbd89918c6e9bb6179fd4627987cb493d0a6fa08c66a28824e26e0f7568
SHA512

bcdf0dee648a5048f6548793803ce2827f78249d0c9d42e2a7c524a02be9c5b292bab5f82938a2e2e607b7f33bbb45431082ba164906dab6475fd0559ec5b331
SSDEEP

1536:4GMQUW6+EMy2SgO2RfZ4HKsysy4LRNd81TFNDJCvG:J96+ny9gOcZ4HPysy4dj81T/DJCv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1264	1256	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 1264	1256	e69fddbd89918c6e9bb6179fd4627987cb493d0a6fa08c66a28824e26e0f7568.exe	27
PID 1256 wrote to memory of 1264	1256	e69fddbd89918c6e9bb6179fd4627987cb493d0a6fa08c66a28824e26e0f7568.exe	27
PID 1256 wrote to memory of 1264	1256	e69fddbd89918c6e9bb6179fd4627987cb493d0a6fa08c66a28824e26e0f7568.exe	27
PID 1256 wrote to memory of 1264	1256	e69fddbd89918c6e9bb6179fd4627987cb493d0a6fa08c66a28824e26e0f7568.exe	27

C:\Users\Admin\AppData\Local\Temp\e69fddbd89918c6e9bb6179fd4627987cb493d0a6fa08c66a28824e26e0f7568.exe
"C:\Users\Admin\AppData\Local\Temp\e69fddbd89918c6e9bb6179fd4627987cb493d0a6fa08c66a28824e26e0f7568.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 36
  2⤵
  - Program crash
  PID:1264

memory/1256-54-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download