e0614ad1710607adf8cdb62d45c15e95b1e19e895c391e3f2d1e20f47037452b

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:07

Target

e0614ad1710607adf8cdb62d45c15e95b1e19e895c391e3f2d1e20f47037452b.exe
Size

137KB
MD5

2bae4b414dc1207afb62d5aef2e06ae3
SHA1

630bf52862c56aa20b3eaf9c056e57a9dd887ab2
SHA256

e0614ad1710607adf8cdb62d45c15e95b1e19e895c391e3f2d1e20f47037452b
SHA512

143f7c2f7a218a2b3f42e1bc5015e97c2e952d3792f1fd0965071bd3e7c29a690c29a5fc84c45dcd9fb149669fc716c8381b819f7526710773e91e8921f31e59
SSDEEP

3072:9y2AdZSA3VOOlHPvrYLBT8zqE9r9ybrSEsUwq75:9y2AdZSUVOoH7oBTamN5

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1080 2016 WerFault.exe e0614ad1710607adf8cdb62d45c15e95b1e19e895c391e3f2d1e20f47037452b.exe

pid	pid_target	process	target process
1080	2016	WerFault.exe	e0614ad1710607adf8cdb62d45c15e95b1e19e895c391e3f2d1e20f47037452b.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e0614ad1710607adf8cdb62d45c15e95b1e19e895c391e3f2d1e20f47037452b.exe

description	pid	process	target process
PID 2016 wrote to memory of 1080	2016	e0614ad1710607adf8cdb62d45c15e95b1e19e895c391e3f2d1e20f47037452b.exe	WerFault.exe
PID 2016 wrote to memory of 1080	2016	e0614ad1710607adf8cdb62d45c15e95b1e19e895c391e3f2d1e20f47037452b.exe	WerFault.exe
PID 2016 wrote to memory of 1080	2016	e0614ad1710607adf8cdb62d45c15e95b1e19e895c391e3f2d1e20f47037452b.exe	WerFault.exe
PID 2016 wrote to memory of 1080	2016	e0614ad1710607adf8cdb62d45c15e95b1e19e895c391e3f2d1e20f47037452b.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e0614ad1710607adf8cdb62d45c15e95b1e19e895c391e3f2d1e20f47037452b.exe
"C:\Users\Admin\AppData\Local\Temp\e0614ad1710607adf8cdb62d45c15e95b1e19e895c391e3f2d1e20f47037452b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 128
2⤵
- Program crash
PID:1080

memory/1080-54-0x0000000000000000-mapping.dmp

Download
memory/2016-55-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download