e7abcf0f8d72a33208e19d79b5e85cf684308205e84c24bc299a0962e42cbde8

Analysis

max time kernel
39s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:32

Target

e7abcf0f8d72a33208e19d79b5e85cf684308205e84c24bc299a0962e42cbde8.exe
Size

76KB
MD5

09427a61f7ab6f9d22312e6087c9c275
SHA1

411c025af156f31caf334140bf2d713348715f89
SHA256

e7abcf0f8d72a33208e19d79b5e85cf684308205e84c24bc299a0962e42cbde8
SHA512

60345f6ca43674263407295fbc553fb736d75a2b5abe8c2d2d892b8cacc0430fb06ff443f28b082b7b021070d829eb5364a1a764c0a87d40c5df161396af0334
SSDEEP

1536:3qrK+vo+YMDK+pVv0MuH6idOsUoF64q7HxojEErxTWDTMqhGKYIZTET8x:3qrvo+7l3v3Y6idOVofq7H+jBkMqhGKn

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

856 1252 WerFault.exe e7abcf0f8d72a33208e19d79b5e85cf684308205e84c24bc299a0962e42cbde8.exe

pid	pid_target	process	target process
856	1252	WerFault.exe	e7abcf0f8d72a33208e19d79b5e85cf684308205e84c24bc299a0962e42cbde8.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e7abcf0f8d72a33208e19d79b5e85cf684308205e84c24bc299a0962e42cbde8.exe

description	pid	process	target process
PID 1252 wrote to memory of 856	1252	e7abcf0f8d72a33208e19d79b5e85cf684308205e84c24bc299a0962e42cbde8.exe	WerFault.exe
PID 1252 wrote to memory of 856	1252	e7abcf0f8d72a33208e19d79b5e85cf684308205e84c24bc299a0962e42cbde8.exe	WerFault.exe
PID 1252 wrote to memory of 856	1252	e7abcf0f8d72a33208e19d79b5e85cf684308205e84c24bc299a0962e42cbde8.exe	WerFault.exe
PID 1252 wrote to memory of 856	1252	e7abcf0f8d72a33208e19d79b5e85cf684308205e84c24bc299a0962e42cbde8.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e7abcf0f8d72a33208e19d79b5e85cf684308205e84c24bc299a0962e42cbde8.exe
"C:\Users\Admin\AppData\Local\Temp\e7abcf0f8d72a33208e19d79b5e85cf684308205e84c24bc299a0962e42cbde8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 36
2⤵
- Program crash
PID:856

memory/856-54-0x0000000000000000-mapping.dmp

Download
memory/1252-55-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download