eb6812aac42d784f7900fa25173f1b5eb3f71ae724dfcf6c849452fc30fa33a7

Analysis

max time kernel
94s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 10:47

Target

eb6812aac42d784f7900fa25173f1b5eb3f71ae724dfcf6c849452fc30fa33a7.exe
Size

422KB
MD5

bc3d625f4c6cae0d6e3e07b440ebf964
SHA1

968b4133a5e066bc9706e63d33e6c7a2b81a24da
SHA256

eb6812aac42d784f7900fa25173f1b5eb3f71ae724dfcf6c849452fc30fa33a7
SHA512

ba211a9ae4b17cf79fbc261f867e63428d65cbab69a5a80e857596676a2263c66335948fec414884dd00395715ef3194550b9f9cdc9c6b163a30dc2831fc0d2c
SSDEEP

6144:6ptaLYmrve/eS4J6MtBmCKVBzakE7G/XAxb5vSr31RYDrLhCONHV:fLdueSQDtBmJVBz+1xbh831RYDrZH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
600	1836	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 600	1836	eb6812aac42d784f7900fa25173f1b5eb3f71ae724dfcf6c849452fc30fa33a7.exe	28
PID 1836 wrote to memory of 600	1836	eb6812aac42d784f7900fa25173f1b5eb3f71ae724dfcf6c849452fc30fa33a7.exe	28
PID 1836 wrote to memory of 600	1836	eb6812aac42d784f7900fa25173f1b5eb3f71ae724dfcf6c849452fc30fa33a7.exe	28
PID 1836 wrote to memory of 600	1836	eb6812aac42d784f7900fa25173f1b5eb3f71ae724dfcf6c849452fc30fa33a7.exe	28

C:\Users\Admin\AppData\Local\Temp\eb6812aac42d784f7900fa25173f1b5eb3f71ae724dfcf6c849452fc30fa33a7.exe
"C:\Users\Admin\AppData\Local\Temp\eb6812aac42d784f7900fa25173f1b5eb3f71ae724dfcf6c849452fc30fa33a7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 196
  2⤵
  - Program crash
  PID:600

memory/1836-54-0x0000000075151000-0x0000000075153000-memory.dmp

Filesize
8KB

Download
memory/1836-55-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1836-57-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download