2e881b22ddf122fa472f3f84a83b95d803f35cbb959f9acdf958097a2e476d80

Analysis

max time kernel
2s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 19:12

Target

2e881b22ddf122fa472f3f84a83b95d803f35cbb959f9acdf958097a2e476d80.exe
Size

74KB
MD5

53539222ad200034473224972b1558e6
SHA1

111e4cb801d89726575a21aa63bd780e205bdfe0
SHA256

2e881b22ddf122fa472f3f84a83b95d803f35cbb959f9acdf958097a2e476d80
SHA512

3d0fd730c081428b4823857e0b614b8732539435fabaa0af4db9d81d95825ef072c9063453cee34ed7b3546a25bf666bc266587fccfba9bfabb7f5a159bebebe
SSDEEP

1536:MrUlDSC0WWOm6e6mm/ASwwb5RUUgWAlKjBnRrzj20Yzs9VO6J3Q:k8DTNWOhe69/Xwwb5RUUgJlGFdYzs9HK

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1756 1324 WerFault.exe 2e881b22ddf122fa472f3f84a83b95d803f35cbb959f9acdf958097a2e476d80.exe

pid	pid_target	process	target process
1756	1324	WerFault.exe	2e881b22ddf122fa472f3f84a83b95d803f35cbb959f9acdf958097a2e476d80.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2e881b22ddf122fa472f3f84a83b95d803f35cbb959f9acdf958097a2e476d80.exe

description	pid	process	target process
PID 1324 wrote to memory of 1756	1324	2e881b22ddf122fa472f3f84a83b95d803f35cbb959f9acdf958097a2e476d80.exe	WerFault.exe
PID 1324 wrote to memory of 1756	1324	2e881b22ddf122fa472f3f84a83b95d803f35cbb959f9acdf958097a2e476d80.exe	WerFault.exe
PID 1324 wrote to memory of 1756	1324	2e881b22ddf122fa472f3f84a83b95d803f35cbb959f9acdf958097a2e476d80.exe	WerFault.exe
PID 1324 wrote to memory of 1756	1324	2e881b22ddf122fa472f3f84a83b95d803f35cbb959f9acdf958097a2e476d80.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2e881b22ddf122fa472f3f84a83b95d803f35cbb959f9acdf958097a2e476d80.exe
"C:\Users\Admin\AppData\Local\Temp\2e881b22ddf122fa472f3f84a83b95d803f35cbb959f9acdf958097a2e476d80.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 88
2⤵
- Program crash
PID:1756