3e857d93cc41f666f74a046c0b1c7cec15a41bfa782f20151e74260710082e5c

Analysis

max time kernel
28s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:18

Target

3e857d93cc41f666f74a046c0b1c7cec15a41bfa782f20151e74260710082e5c.exe
Size

91KB
MD5

65d021ab472d46eb8d3f1d94dac5d3b0
SHA1

ee6e8744b5a66b28fd2d68c241e630f9f573e0e3
SHA256

3e857d93cc41f666f74a046c0b1c7cec15a41bfa782f20151e74260710082e5c
SHA512

4a42e57562686a22be7f7d45486ec63f76f8f90fc7621905abe9b2515e08fccdbf0d6cf290e95fc9e2935c0cd591d0874daf7a435806685cb62a840e51fc7a29
SSDEEP

1536:ktQXUVc5fGiyyNj1Gbd9o7SeLlatsm8gG2SiZrZ83YacIyP/69QAq0Gb8/Z5H83l:zXUi5fTtIbuSeLUWf/irKYBbWq0GQP0l

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1928 1392 WerFault.exe 3e857d93cc41f666f74a046c0b1c7cec15a41bfa782f20151e74260710082e5c.exe

pid	pid_target	process	target process
1928	1392	WerFault.exe	3e857d93cc41f666f74a046c0b1c7cec15a41bfa782f20151e74260710082e5c.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3e857d93cc41f666f74a046c0b1c7cec15a41bfa782f20151e74260710082e5c.exe

description	pid	process	target process
PID 1392 wrote to memory of 1928	1392	3e857d93cc41f666f74a046c0b1c7cec15a41bfa782f20151e74260710082e5c.exe	WerFault.exe
PID 1392 wrote to memory of 1928	1392	3e857d93cc41f666f74a046c0b1c7cec15a41bfa782f20151e74260710082e5c.exe	WerFault.exe
PID 1392 wrote to memory of 1928	1392	3e857d93cc41f666f74a046c0b1c7cec15a41bfa782f20151e74260710082e5c.exe	WerFault.exe
PID 1392 wrote to memory of 1928	1392	3e857d93cc41f666f74a046c0b1c7cec15a41bfa782f20151e74260710082e5c.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3e857d93cc41f666f74a046c0b1c7cec15a41bfa782f20151e74260710082e5c.exe
"C:\Users\Admin\AppData\Local\Temp\3e857d93cc41f666f74a046c0b1c7cec15a41bfa782f20151e74260710082e5c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 36
  2⤵
  - Program crash
  PID:1928

memory/1392-55-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1928-54-0x0000000000000000-mapping.dmp

Download