2e3c510e8507247efe31275a42f020c99736b0b84d011d85d16f0cc2435ef810

Analysis

max time kernel
22s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:07

Target

2e3c510e8507247efe31275a42f020c99736b0b84d011d85d16f0cc2435ef810.exe
Size

352KB
MD5

5f72734a1fd89193202d60f0bb9230d0
SHA1

abcc9a94b72db9f4c9aedcdad2891f974cd74992
SHA256

2e3c510e8507247efe31275a42f020c99736b0b84d011d85d16f0cc2435ef810
SHA512

29b75ec199e35541d2bc347e62f2423f46c2f79b19a1c971717f379505f955f095da1a0927a6791321650cdfe924db8b9ba4282d00f601d438241dc32363f5f9
SSDEEP

6144:UGPEvbL4+tRfb9puSt/jbO/4MvJZju0WBD3HGpzo0naGO:UpX4+tRfb9Z9O/pviBWPaGO

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1328 1144 WerFault.exe 2e3c510e8507247efe31275a42f020c99736b0b84d011d85d16f0cc2435ef810.exe

pid	pid_target	process	target process
1328	1144	WerFault.exe	2e3c510e8507247efe31275a42f020c99736b0b84d011d85d16f0cc2435ef810.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2e3c510e8507247efe31275a42f020c99736b0b84d011d85d16f0cc2435ef810.exe

description	pid	process	target process
PID 1144 wrote to memory of 1328	1144	2e3c510e8507247efe31275a42f020c99736b0b84d011d85d16f0cc2435ef810.exe	WerFault.exe
PID 1144 wrote to memory of 1328	1144	2e3c510e8507247efe31275a42f020c99736b0b84d011d85d16f0cc2435ef810.exe	WerFault.exe
PID 1144 wrote to memory of 1328	1144	2e3c510e8507247efe31275a42f020c99736b0b84d011d85d16f0cc2435ef810.exe	WerFault.exe
PID 1144 wrote to memory of 1328	1144	2e3c510e8507247efe31275a42f020c99736b0b84d011d85d16f0cc2435ef810.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2e3c510e8507247efe31275a42f020c99736b0b84d011d85d16f0cc2435ef810.exe
"C:\Users\Admin\AppData\Local\Temp\2e3c510e8507247efe31275a42f020c99736b0b84d011d85d16f0cc2435ef810.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1144 -s 184
2⤵
- Program crash
PID:1328

memory/1144-54-0x0000000075F01000-0x0000000075F03000-memory.dmp

Filesize
8KB

Download
memory/1144-56-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1328-55-0x0000000000000000-mapping.dmp

Download