3e353e37d82e483d6d6e0c033c3f1d6f825ce691b68ca9057082b7ac36892498

Analysis

max time kernel
2s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 03:58

Target

3e353e37d82e483d6d6e0c033c3f1d6f825ce691b68ca9057082b7ac36892498.exe
Size

64KB
MD5

2005119fc004f1f548ee2d3213140d4c
SHA1

89e2cd931dd0a3cd9a73b19883789a8b40f18f74
SHA256

3e353e37d82e483d6d6e0c033c3f1d6f825ce691b68ca9057082b7ac36892498
SHA512

91cb756e781f89125ea450d2f2bf70016dc3a181e3af40e555be5ccdffa06ffbe311bd7f1914979126f56fde4c7a95f3ee6a4f3c817e0214ef78d91c4bae85ad
SSDEEP

768:YXM0aPJQTlS/42KGA8MpXZv9HYGN3hFRLQpjKNQ806OLAlUybYAgIq2/D59x:YTwQQA8MpXZlHJtshK4qSOqwlf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1188	1648	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 1188	1648	3e353e37d82e483d6d6e0c033c3f1d6f825ce691b68ca9057082b7ac36892498.exe	28
PID 1648 wrote to memory of 1188	1648	3e353e37d82e483d6d6e0c033c3f1d6f825ce691b68ca9057082b7ac36892498.exe	28
PID 1648 wrote to memory of 1188	1648	3e353e37d82e483d6d6e0c033c3f1d6f825ce691b68ca9057082b7ac36892498.exe	28
PID 1648 wrote to memory of 1188	1648	3e353e37d82e483d6d6e0c033c3f1d6f825ce691b68ca9057082b7ac36892498.exe	28

C:\Users\Admin\AppData\Local\Temp\3e353e37d82e483d6d6e0c033c3f1d6f825ce691b68ca9057082b7ac36892498.exe
"C:\Users\Admin\AppData\Local\Temp\3e353e37d82e483d6d6e0c033c3f1d6f825ce691b68ca9057082b7ac36892498.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 88
  2⤵
  - Program crash
  PID:1188