0e60f47c01b40ea665903f493c63811b20b7512cb8699367c4edaab104142a8c

Analysis

max time kernel
46s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 09:17

Target

0e60f47c01b40ea665903f493c63811b20b7512cb8699367c4edaab104142a8c.exe
Size

4.5MB
MD5

a7a29a2a4df967935388093f74406698
SHA1

f85e568c0c017208a1164037ec314fdf9c192c09
SHA256

0e60f47c01b40ea665903f493c63811b20b7512cb8699367c4edaab104142a8c
SHA512

4bee042c7d22c5a0cbdf31d4029487746c4f334efd1c0af24ede6b43efbbb4912fc15ed9bbd450d9470bc761b0caba8cc89617b1b008b252f1e13f07a6c1b63d
SSDEEP

98304:JO4tq8r7O4ps1ZrbhEPDeO4tq8r7O4ps1ZrbhEPLGUQO/fsiR6vmBNLfmO:fB9p0ZfIDgB9p0ZfI6U/fMvwcO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1224	1416	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 1224	1416	0e60f47c01b40ea665903f493c63811b20b7512cb8699367c4edaab104142a8c.exe	27
PID 1416 wrote to memory of 1224	1416	0e60f47c01b40ea665903f493c63811b20b7512cb8699367c4edaab104142a8c.exe	27
PID 1416 wrote to memory of 1224	1416	0e60f47c01b40ea665903f493c63811b20b7512cb8699367c4edaab104142a8c.exe	27
PID 1416 wrote to memory of 1224	1416	0e60f47c01b40ea665903f493c63811b20b7512cb8699367c4edaab104142a8c.exe	27

C:\Users\Admin\AppData\Local\Temp\0e60f47c01b40ea665903f493c63811b20b7512cb8699367c4edaab104142a8c.exe
"C:\Users\Admin\AppData\Local\Temp\0e60f47c01b40ea665903f493c63811b20b7512cb8699367c4edaab104142a8c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1416 -s 92
  2⤵
  - Program crash
  PID:1224

memory/1416-55-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download