ec31ce7347489bc8d69a4129d3c83af2cc77cc81e1f798269c28c88b2127ab99

Analysis

max time kernel
32s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 12:21

Target

ec31ce7347489bc8d69a4129d3c83af2cc77cc81e1f798269c28c88b2127ab99.exe
Size

512KB
MD5

9665a2b35059b9677da198040685f145
SHA1

a46412be73d48ff110ab74d2ca11886395ca156a
SHA256

ec31ce7347489bc8d69a4129d3c83af2cc77cc81e1f798269c28c88b2127ab99
SHA512

d68e7445b92d6d7fa98940ab4103c85899447f02cb36e1a242653f69e6e9bef13c80c3e40f9584c4465aa308df806b18e30f3f460b5f5cd7e8f576aa342257b6
SSDEEP

6144:jvLpPV4I/w589NjwRmqZHF7S1M4IBT0yNY4kMfwWiuBnBuf:jvLpPnNW7Sm41yNY4kMfwWq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1640	1376	WerFault.exe	13

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 1640	1376	ec31ce7347489bc8d69a4129d3c83af2cc77cc81e1f798269c28c88b2127ab99.exe	28
PID 1376 wrote to memory of 1640	1376	ec31ce7347489bc8d69a4129d3c83af2cc77cc81e1f798269c28c88b2127ab99.exe	28
PID 1376 wrote to memory of 1640	1376	ec31ce7347489bc8d69a4129d3c83af2cc77cc81e1f798269c28c88b2127ab99.exe	28
PID 1376 wrote to memory of 1640	1376	ec31ce7347489bc8d69a4129d3c83af2cc77cc81e1f798269c28c88b2127ab99.exe	28

C:\Users\Admin\AppData\Local\Temp\ec31ce7347489bc8d69a4129d3c83af2cc77cc81e1f798269c28c88b2127ab99.exe
"C:\Users\Admin\AppData\Local\Temp\ec31ce7347489bc8d69a4129d3c83af2cc77cc81e1f798269c28c88b2127ab99.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 128
  2⤵
  - Program crash
  PID:1640

memory/1376-54-0x0000000075921000-0x0000000075923000-memory.dmp

Filesize
8KB

Download
memory/1376-56-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download