2ec4d976bed9a3825a35359e0afd7025b872db610f9d3b01613096e6fde21204

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 20:22

Target

2ec4d976bed9a3825a35359e0afd7025b872db610f9d3b01613096e6fde21204.exe
Size

320KB
MD5

a1a97d30f905c8069be843ebb47144d0
SHA1

d7791b3720f34a7c176dde2f9e1d73ea717f2aea
SHA256

2ec4d976bed9a3825a35359e0afd7025b872db610f9d3b01613096e6fde21204
SHA512

84e0027a9d2ba875ca32a82f6b75205a13f537ec702c9244457f2074922452e81f7853bf5550fec6c906d8a83b4eb41fa12abaac913bcbfe5c354013ae50637e
SSDEEP

6144:HAqXBFoPSH2RfS155ONNXBuWoJBO9OMbHLkAqF7Ief9UmM7/uT:DXBqPQ2EB0NxDIBuOFe7/uT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1204	1280	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 1204	1280	2ec4d976bed9a3825a35359e0afd7025b872db610f9d3b01613096e6fde21204.exe	27
PID 1280 wrote to memory of 1204	1280	2ec4d976bed9a3825a35359e0afd7025b872db610f9d3b01613096e6fde21204.exe	27
PID 1280 wrote to memory of 1204	1280	2ec4d976bed9a3825a35359e0afd7025b872db610f9d3b01613096e6fde21204.exe	27
PID 1280 wrote to memory of 1204	1280	2ec4d976bed9a3825a35359e0afd7025b872db610f9d3b01613096e6fde21204.exe	27

C:\Users\Admin\AppData\Local\Temp\2ec4d976bed9a3825a35359e0afd7025b872db610f9d3b01613096e6fde21204.exe
"C:\Users\Admin\AppData\Local\Temp\2ec4d976bed9a3825a35359e0afd7025b872db610f9d3b01613096e6fde21204.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1280 -s 36
  2⤵
  - Program crash
  PID:1204

memory/1280-55-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download