ec0622ba140178d86fe902039065b811667c51f1f84ef80d06aae3c9170cbc9f

Analysis

max time kernel
40s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 20:52

Target

ec0622ba140178d86fe902039065b811667c51f1f84ef80d06aae3c9170cbc9f.exe
Size

99KB
MD5

add04fe1ffce1b32be60283a39599bf2
SHA1

c2db322da3f3fa5b6a0dbfeba320ac07147291e3
SHA256

ec0622ba140178d86fe902039065b811667c51f1f84ef80d06aae3c9170cbc9f
SHA512

dd04d219ce69f9f077da0afef814676f77b67271f8baa73af463337ea6e1894dac82b0a2d9e2498d9fa21af93abdec6fc65d5ca4467b5600b7f033e6cb03c42f
SSDEEP

1536:6FgrMzhvLKaLWx0TRKAK9OdBnVP9ZXGqUXyhj+7OWtke1FS96/k:UgW1Bd+9ODXRGqUXyhj+R1Dc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
864	1356	WerFault.exe	27

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1356	2012	ec0622ba140178d86fe902039065b811667c51f1f84ef80d06aae3c9170cbc9f.exe	27
PID 2012 wrote to memory of 1356	2012	ec0622ba140178d86fe902039065b811667c51f1f84ef80d06aae3c9170cbc9f.exe	27
PID 2012 wrote to memory of 1356	2012	ec0622ba140178d86fe902039065b811667c51f1f84ef80d06aae3c9170cbc9f.exe	27
PID 2012 wrote to memory of 1356	2012	ec0622ba140178d86fe902039065b811667c51f1f84ef80d06aae3c9170cbc9f.exe	27
PID 2012 wrote to memory of 1356	2012	ec0622ba140178d86fe902039065b811667c51f1f84ef80d06aae3c9170cbc9f.exe	27
PID 2012 wrote to memory of 1356	2012	ec0622ba140178d86fe902039065b811667c51f1f84ef80d06aae3c9170cbc9f.exe	27
PID 2012 wrote to memory of 1356	2012	ec0622ba140178d86fe902039065b811667c51f1f84ef80d06aae3c9170cbc9f.exe	27
PID 2012 wrote to memory of 1356	2012	ec0622ba140178d86fe902039065b811667c51f1f84ef80d06aae3c9170cbc9f.exe	27
PID 2012 wrote to memory of 1356	2012	ec0622ba140178d86fe902039065b811667c51f1f84ef80d06aae3c9170cbc9f.exe	27
PID 1356 wrote to memory of 864	1356	explorer.exe	28
PID 1356 wrote to memory of 864	1356	explorer.exe	28
PID 1356 wrote to memory of 864	1356	explorer.exe	28
PID 1356 wrote to memory of 864	1356	explorer.exe	28

C:\Users\Admin\AppData\Local\Temp\ec0622ba140178d86fe902039065b811667c51f1f84ef80d06aae3c9170cbc9f.exe
"C:\Users\Admin\AppData\Local\Temp\ec0622ba140178d86fe902039065b811667c51f1f84ef80d06aae3c9170cbc9f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\SysWOW64\explorer.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 232
    3⤵
    - Program crash
    PID:864

memory/1356-57-0x00000000000D0000-0x00000000000D4000-memory.dmp

Filesize
16KB

Download
memory/1356-59-0x00000000000E0000-0x00000000000E3000-memory.dmp

Filesize
12KB

Download
memory/1356-63-0x00000000747F1000-0x00000000747F3000-memory.dmp

Filesize
8KB

Download
memory/2012-54-0x0000000075841000-0x0000000075843000-memory.dmp

Filesize
8KB

Download
memory/2012-55-0x0000000000250000-0x0000000000254000-memory.dmp

Filesize
16KB

Download
memory/2012-56-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download