e0c1668a1a59138ead4b97c701b8dac43edda996e671357506dcf5438c45f167

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
28/10/2022, 23:33

Target

e0c1668a1a59138ead4b97c701b8dac43edda996e671357506dcf5438c45f167.exe
Size

107KB
MD5

04646a84e10504a489f602d6ff0603d0
SHA1

d4280ff26861ec102ca37480ec257443fc6d71c0
SHA256

e0c1668a1a59138ead4b97c701b8dac43edda996e671357506dcf5438c45f167
SHA512

5e13f57e482083802216d5c7b845fce14c7385e6e695beb24616d2aa9a94ab31318d1942291cc1ea6a560af3e7cf47d29fa1787b9fe752c4e1548043b697c181
SSDEEP

1536:INm5o5/J1iuphOXwuSaejkSZsRARKujE7OSLkVOQjNpjVrs2ryrd1vUQuqQGFNif:sZiupZurwpsRARLE7O9jNHs2quGf9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2032	1724	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2032	1724	e0c1668a1a59138ead4b97c701b8dac43edda996e671357506dcf5438c45f167.exe	27
PID 1724 wrote to memory of 2032	1724	e0c1668a1a59138ead4b97c701b8dac43edda996e671357506dcf5438c45f167.exe	27
PID 1724 wrote to memory of 2032	1724	e0c1668a1a59138ead4b97c701b8dac43edda996e671357506dcf5438c45f167.exe	27
PID 1724 wrote to memory of 2032	1724	e0c1668a1a59138ead4b97c701b8dac43edda996e671357506dcf5438c45f167.exe	27

C:\Users\Admin\AppData\Local\Temp\e0c1668a1a59138ead4b97c701b8dac43edda996e671357506dcf5438c45f167.exe
"C:\Users\Admin\AppData\Local\Temp\e0c1668a1a59138ead4b97c701b8dac43edda996e671357506dcf5438c45f167.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 36
  2⤵
  - Program crash
  PID:2032

memory/1724-55-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download