e499f920a226c5e611d40952f7a4c592d7a8cdd37067dfa6cc275c39c806b62f

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 03:33

Target

e499f920a226c5e611d40952f7a4c592d7a8cdd37067dfa6cc275c39c806b62f.exe
Size

419KB
MD5

926e7cf29c288a9d9aa81659e743719f
SHA1

42f131da9603e29414e0213f63a96af7293deaf9
SHA256

e499f920a226c5e611d40952f7a4c592d7a8cdd37067dfa6cc275c39c806b62f
SHA512

9ce0fb184e767a1567e21faafaa16e454b3240fd01f60dc0d4499e0e6171dc61550509aa828b19068aa8b4b14871843a3db8f3ef1aa04d6c3f95d708d4659e58
SSDEEP

6144:Llq55uLuwbE14R0V4LoYFsPOHw2R0/UqMMJKdBu021:cNwbEiw4MYFsPOHiJKdkT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1228	1204	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1228	1204	e499f920a226c5e611d40952f7a4c592d7a8cdd37067dfa6cc275c39c806b62f.exe	27
PID 1204 wrote to memory of 1228	1204	e499f920a226c5e611d40952f7a4c592d7a8cdd37067dfa6cc275c39c806b62f.exe	27
PID 1204 wrote to memory of 1228	1204	e499f920a226c5e611d40952f7a4c592d7a8cdd37067dfa6cc275c39c806b62f.exe	27
PID 1204 wrote to memory of 1228	1204	e499f920a226c5e611d40952f7a4c592d7a8cdd37067dfa6cc275c39c806b62f.exe	27

C:\Users\Admin\AppData\Local\Temp\e499f920a226c5e611d40952f7a4c592d7a8cdd37067dfa6cc275c39c806b62f.exe
"C:\Users\Admin\AppData\Local\Temp\e499f920a226c5e611d40952f7a4c592d7a8cdd37067dfa6cc275c39c806b62f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 160
  2⤵
  - Program crash
  PID:1228

memory/1204-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download