2ce2e95d2c68880ba31d862cc41f9d9331567c3d865576682988bc5361c84128

Analysis

max time kernel
39s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 14:12

Target

2ce2e95d2c68880ba31d862cc41f9d9331567c3d865576682988bc5361c84128.exe
Size

76KB
MD5

0e9872992434c99790f1576bf2f4c223
SHA1

443d8c211b80e0103cabd7102b7c0e7ee1e87da5
SHA256

2ce2e95d2c68880ba31d862cc41f9d9331567c3d865576682988bc5361c84128
SHA512

7a9ca803ebf3a4ad6d91e5ea8fb736a384e84b7ef5270c6539b2a3b4a467daed34253bf88872aba2cc5ca7fd38df29718687e09536f78245e1aa065dcdff6b2c
SSDEEP

1536:kYYFoFfiTatr8Utj4egzGfLw70KKYpRv9wmuoe2QGfwrpcUjEErxTWDTMqhGKYIn:aFoFKqQYj4e3EgwZjIEfmpBjBkMqhGKn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
964	1184	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 964	1184	2ce2e95d2c68880ba31d862cc41f9d9331567c3d865576682988bc5361c84128.exe	26
PID 1184 wrote to memory of 964	1184	2ce2e95d2c68880ba31d862cc41f9d9331567c3d865576682988bc5361c84128.exe	26
PID 1184 wrote to memory of 964	1184	2ce2e95d2c68880ba31d862cc41f9d9331567c3d865576682988bc5361c84128.exe	26
PID 1184 wrote to memory of 964	1184	2ce2e95d2c68880ba31d862cc41f9d9331567c3d865576682988bc5361c84128.exe	26

C:\Users\Admin\AppData\Local\Temp\2ce2e95d2c68880ba31d862cc41f9d9331567c3d865576682988bc5361c84128.exe
"C:\Users\Admin\AppData\Local\Temp\2ce2e95d2c68880ba31d862cc41f9d9331567c3d865576682988bc5361c84128.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1184 -s 36
  2⤵
  - Program crash
  PID:964

memory/964-55-0x0000000000000000-mapping.dmp

Download
memory/1184-54-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download