eded04011e2430266e5c6759f925353312f3c638383dcf25641b0603e9274880

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:56

Target

eded04011e2430266e5c6759f925353312f3c638383dcf25641b0603e9274880.exe
Size

65KB
MD5

056e36b3bdd710e10cfab4bdfbd212ae
SHA1

4686f38124dc7986842b3d4f39a59d875ce2dfd2
SHA256

eded04011e2430266e5c6759f925353312f3c638383dcf25641b0603e9274880
SHA512

80e158e8a161d161d3a51635d87a9cd71661a84387ee424b16c7ddb613331ca24304ec59bd71f5c95db363529160f318212a060f14e46ef030510eca5ddc57e9
SSDEEP

1536:XuoATp+AW5oUEVWqX6nk59QFAqj4usqxIl4Zr:dATpuydVEOyqGnsqxIl4Z

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2012 1284 WerFault.exe eded04011e2430266e5c6759f925353312f3c638383dcf25641b0603e9274880.exe

pid	pid_target	process	target process
2012	1284	WerFault.exe	eded04011e2430266e5c6759f925353312f3c638383dcf25641b0603e9274880.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

eded04011e2430266e5c6759f925353312f3c638383dcf25641b0603e9274880.exe

description	pid	process	target process
PID 1284 wrote to memory of 2012	1284	eded04011e2430266e5c6759f925353312f3c638383dcf25641b0603e9274880.exe	WerFault.exe
PID 1284 wrote to memory of 2012	1284	eded04011e2430266e5c6759f925353312f3c638383dcf25641b0603e9274880.exe	WerFault.exe
PID 1284 wrote to memory of 2012	1284	eded04011e2430266e5c6759f925353312f3c638383dcf25641b0603e9274880.exe	WerFault.exe
PID 1284 wrote to memory of 2012	1284	eded04011e2430266e5c6759f925353312f3c638383dcf25641b0603e9274880.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\eded04011e2430266e5c6759f925353312f3c638383dcf25641b0603e9274880.exe
"C:\Users\Admin\AppData\Local\Temp\eded04011e2430266e5c6759f925353312f3c638383dcf25641b0603e9274880.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1284 -s 192
2⤵
- Program crash
PID:2012

memory/1284-54-0x00000000762E1000-0x00000000762E3000-memory.dmp

Filesize
8KB

Download
memory/2012-55-0x0000000000000000-mapping.dmp

Download