fe0e6b8c7fe8398228da4909da67f28af9023b53bd1df3ea6b99aeb97323add2

Analysis

max time kernel
4s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 22:20

Target

fe0e6b8c7fe8398228da4909da67f28af9023b53bd1df3ea6b99aeb97323add2.exe
Size

71KB
MD5

9fb9aacfd3b185eb0ae6b331ec2fa073
SHA1

87ac7ad9a014ce21be6057d2fb40ae4e08f8bdd5
SHA256

fe0e6b8c7fe8398228da4909da67f28af9023b53bd1df3ea6b99aeb97323add2
SHA512

296d578887c8813643f33f814872ce3924ec096ce5ca276b8c269bba5342255bdf3f9f7b127c1c77c78654a635ead9d4fb1972fc92e29743cc5b6bffbb48df52
SSDEEP

1536:k2jgFOzyqBAI/rAfTC17rBIMeFZLELnLNFmKeYCIy:kIWOWYAIjALCBIsXzly

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1172	1760	WerFault.exe	13

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 1172	1760	fe0e6b8c7fe8398228da4909da67f28af9023b53bd1df3ea6b99aeb97323add2.exe	28
PID 1760 wrote to memory of 1172	1760	fe0e6b8c7fe8398228da4909da67f28af9023b53bd1df3ea6b99aeb97323add2.exe	28
PID 1760 wrote to memory of 1172	1760	fe0e6b8c7fe8398228da4909da67f28af9023b53bd1df3ea6b99aeb97323add2.exe	28
PID 1760 wrote to memory of 1172	1760	fe0e6b8c7fe8398228da4909da67f28af9023b53bd1df3ea6b99aeb97323add2.exe	28

C:\Users\Admin\AppData\Local\Temp\fe0e6b8c7fe8398228da4909da67f28af9023b53bd1df3ea6b99aeb97323add2.exe
"C:\Users\Admin\AppData\Local\Temp\fe0e6b8c7fe8398228da4909da67f28af9023b53bd1df3ea6b99aeb97323add2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 36
  2⤵
  - Program crash
  PID:1172

memory/1760-55-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download