7e2c2705bb6ffc702215487914a7100a638ce6f188969ff4a63ff2788d6a7a4d

Analysis

max time kernel
20s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 20:01

Target

7e2c2705bb6ffc702215487914a7100a638ce6f188969ff4a63ff2788d6a7a4d.exe
Size

320KB
MD5

a170dd8928f44cb1907e889e1d82d680
SHA1

c97633b27acbad3045d4738da7bf16de7a5a58ee
SHA256

7e2c2705bb6ffc702215487914a7100a638ce6f188969ff4a63ff2788d6a7a4d
SHA512

87d5ee58d8b81969dfcd3758baaa7cd1377ffea4d03819e8e9315cf1328c079399ab02bd9cd9ed82a4d8a90de34c7a1191c270ba4e11415a5642ea400db987d4
SSDEEP

6144:jFuz4dGVxNuLDQ9yH2RfS155ONNXBuWoJBO9OMbHLkAqF7Ief9UmM7/uT:hS4dmxNuLaw2EB0NxDIBuOFe7/uT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
732	1200	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 732	1200	7e2c2705bb6ffc702215487914a7100a638ce6f188969ff4a63ff2788d6a7a4d.exe	27
PID 1200 wrote to memory of 732	1200	7e2c2705bb6ffc702215487914a7100a638ce6f188969ff4a63ff2788d6a7a4d.exe	27
PID 1200 wrote to memory of 732	1200	7e2c2705bb6ffc702215487914a7100a638ce6f188969ff4a63ff2788d6a7a4d.exe	27
PID 1200 wrote to memory of 732	1200	7e2c2705bb6ffc702215487914a7100a638ce6f188969ff4a63ff2788d6a7a4d.exe	27

C:\Users\Admin\AppData\Local\Temp\7e2c2705bb6ffc702215487914a7100a638ce6f188969ff4a63ff2788d6a7a4d.exe
"C:\Users\Admin\AppData\Local\Temp\7e2c2705bb6ffc702215487914a7100a638ce6f188969ff4a63ff2788d6a7a4d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 36
  2⤵
  - Program crash
  PID:732

memory/1200-54-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download