e9fed4fa5d670515fe42745b701347638e520beec4fbfb3adc15faf96b829101

Analysis

max time kernel
145s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 12:33

Target

e9fed4fa5d670515fe42745b701347638e520beec4fbfb3adc15faf96b829101.exe
Size

270KB
MD5

a73e32ce3edcf75b327fd21a67817e2c
SHA1

72121d0b9de03363568e809a632d051dbbe6a8d6
SHA256

e9fed4fa5d670515fe42745b701347638e520beec4fbfb3adc15faf96b829101
SHA512

a4f1aa279369de78426dc4e3d99c91f6a3a3a98442156043b85f2e69eacd2b493640b890e0c8890233c48a298bb952d17c9e488df95bc54c67b876a171015ea1
SSDEEP

6144:fE+vv+TzksnEtDUbUooOTg/3hnWXDu0yYaSE+m3uR:dvvUzkoM27oOTGRnWXDu0yAmuR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1956	576	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 576 wrote to memory of 1956	576	e9fed4fa5d670515fe42745b701347638e520beec4fbfb3adc15faf96b829101.exe	26
PID 576 wrote to memory of 1956	576	e9fed4fa5d670515fe42745b701347638e520beec4fbfb3adc15faf96b829101.exe	26
PID 576 wrote to memory of 1956	576	e9fed4fa5d670515fe42745b701347638e520beec4fbfb3adc15faf96b829101.exe	26
PID 576 wrote to memory of 1956	576	e9fed4fa5d670515fe42745b701347638e520beec4fbfb3adc15faf96b829101.exe	26

C:\Users\Admin\AppData\Local\Temp\e9fed4fa5d670515fe42745b701347638e520beec4fbfb3adc15faf96b829101.exe
"C:\Users\Admin\AppData\Local\Temp\e9fed4fa5d670515fe42745b701347638e520beec4fbfb3adc15faf96b829101.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 292
  2⤵
  - Program crash
  PID:1956

memory/576-54-0x0000000000400000-0x00000000012BA000-memory.dmp

Filesize
14.7MB

Download
memory/576-55-0x0000000075911000-0x0000000075913000-memory.dmp

Filesize
8KB

Download
memory/576-58-0x0000000000400000-0x00000000012BA000-memory.dmp

Filesize
14.7MB

Download