eaf91cf8081cc88b38638c597954eb3a2ecbffa536a6679da7f686d12a8e26a0

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:20

Target

eaf91cf8081cc88b38638c597954eb3a2ecbffa536a6679da7f686d12a8e26a0.exe
Size

56KB
MD5

e0cb31b7221bf50a6f13b5a9d4c8d263
SHA1

62d897c5aa068015d1da829367fa5017e33229ba
SHA256

eaf91cf8081cc88b38638c597954eb3a2ecbffa536a6679da7f686d12a8e26a0
SHA512

56e89b10227e835b70eea243aa5e6a5178033f1d72a7cde5f366ef75fedfab0755aaad42685cdaccbfd5b4f0465391a92e455f733950ee5c8e25a6b17a7fd0db
SSDEEP

768:CfWwWN/CiRj7ToQtQgaq21cXWTqSrKgAdQMd+vju5/nxUtUQDW6W5Z29jOjVwuVu:OMt7OvqRdn0bu5/TQy6WHGOjRzYjPvem

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1232 1196 WerFault.exe eaf91cf8081cc88b38638c597954eb3a2ecbffa536a6679da7f686d12a8e26a0.exe

pid	pid_target	process	target process
1232	1196	WerFault.exe	eaf91cf8081cc88b38638c597954eb3a2ecbffa536a6679da7f686d12a8e26a0.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

eaf91cf8081cc88b38638c597954eb3a2ecbffa536a6679da7f686d12a8e26a0.exe

description	pid	process	target process
PID 1196 wrote to memory of 1232	1196	eaf91cf8081cc88b38638c597954eb3a2ecbffa536a6679da7f686d12a8e26a0.exe	WerFault.exe
PID 1196 wrote to memory of 1232	1196	eaf91cf8081cc88b38638c597954eb3a2ecbffa536a6679da7f686d12a8e26a0.exe	WerFault.exe
PID 1196 wrote to memory of 1232	1196	eaf91cf8081cc88b38638c597954eb3a2ecbffa536a6679da7f686d12a8e26a0.exe	WerFault.exe
PID 1196 wrote to memory of 1232	1196	eaf91cf8081cc88b38638c597954eb3a2ecbffa536a6679da7f686d12a8e26a0.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\eaf91cf8081cc88b38638c597954eb3a2ecbffa536a6679da7f686d12a8e26a0.exe
"C:\Users\Admin\AppData\Local\Temp\eaf91cf8081cc88b38638c597954eb3a2ecbffa536a6679da7f686d12a8e26a0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 36
  2⤵
  - Program crash
  PID:1232