e73fc21573886c935c1c61668b48532646bac4002d0eb9bc710b211344404541

Analysis

max time kernel
35s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:15

Target

e73fc21573886c935c1c61668b48532646bac4002d0eb9bc710b211344404541.exe
Size

104KB
MD5

aca1432cf31b187766906700956ec57f
SHA1

b14493da9d1c1b1596d93538e217772e14981210
SHA256

e73fc21573886c935c1c61668b48532646bac4002d0eb9bc710b211344404541
SHA512

908d7b6dac3287cba31a59409392ac7acf0824cf9e0502a4c034480b3fe6f013f658781fd672127163be2f3e46ddc03514002fe3057c216725f3f748a9ffae06
SSDEEP

1536:UNAkPgROpS4CS5VDk5kY1w+wOgW/+Oy6v5UM+PF/Zw5nhp37LJOn03TIg:A7yR4CSXDk5kSRwOgW2sv+w5P379O0

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1700 956 WerFault.exe e73fc21573886c935c1c61668b48532646bac4002d0eb9bc710b211344404541.exe

pid	pid_target	process	target process
1700	956	WerFault.exe	e73fc21573886c935c1c61668b48532646bac4002d0eb9bc710b211344404541.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e73fc21573886c935c1c61668b48532646bac4002d0eb9bc710b211344404541.exe

description	pid	process	target process
PID 956 wrote to memory of 1700	956	e73fc21573886c935c1c61668b48532646bac4002d0eb9bc710b211344404541.exe	WerFault.exe
PID 956 wrote to memory of 1700	956	e73fc21573886c935c1c61668b48532646bac4002d0eb9bc710b211344404541.exe	WerFault.exe
PID 956 wrote to memory of 1700	956	e73fc21573886c935c1c61668b48532646bac4002d0eb9bc710b211344404541.exe	WerFault.exe
PID 956 wrote to memory of 1700	956	e73fc21573886c935c1c61668b48532646bac4002d0eb9bc710b211344404541.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e73fc21573886c935c1c61668b48532646bac4002d0eb9bc710b211344404541.exe
"C:\Users\Admin\AppData\Local\Temp\e73fc21573886c935c1c61668b48532646bac4002d0eb9bc710b211344404541.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 956 -s 44
2⤵
- Program crash
PID:1700