63ed2d5b5b663d2f8abc85d06639fc6bfebeec13f86f5833fa491c70e89e83fd

Analysis

max time kernel
17s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 15:06

Target

63ed2d5b5b663d2f8abc85d06639fc6bfebeec13f86f5833fa491c70e89e83fd.exe
Size

66KB
MD5

0b96438af2d26833679dc351aa593620
SHA1

966bbca75fb81a9fdf8ab2ca8227b70cad4384eb
SHA256

63ed2d5b5b663d2f8abc85d06639fc6bfebeec13f86f5833fa491c70e89e83fd
SHA512

e6182363f0c296c0ba540fd7918637c934fd85893b07a46088bda2682b5e93852c8fd4f68f8322d9d26a24a7712c3025e8d334327b8e1baa6b5d68a5487a261e
SSDEEP

1536:6qlK2UIJs1JhPRn3E9Qh3Isd/u/KzWxRu+EiZgBxVk4yBaY4wW7uiLS7v4:xUIe1R3kQusNu/K6xwniZg9VycF7unA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1992	2028	WerFault.exe	19

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1992	2028	63ed2d5b5b663d2f8abc85d06639fc6bfebeec13f86f5833fa491c70e89e83fd.exe	28
PID 2028 wrote to memory of 1992	2028	63ed2d5b5b663d2f8abc85d06639fc6bfebeec13f86f5833fa491c70e89e83fd.exe	28
PID 2028 wrote to memory of 1992	2028	63ed2d5b5b663d2f8abc85d06639fc6bfebeec13f86f5833fa491c70e89e83fd.exe	28
PID 2028 wrote to memory of 1992	2028	63ed2d5b5b663d2f8abc85d06639fc6bfebeec13f86f5833fa491c70e89e83fd.exe	28

C:\Users\Admin\AppData\Local\Temp\63ed2d5b5b663d2f8abc85d06639fc6bfebeec13f86f5833fa491c70e89e83fd.exe
"C:\Users\Admin\AppData\Local\Temp\63ed2d5b5b663d2f8abc85d06639fc6bfebeec13f86f5833fa491c70e89e83fd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 36
  2⤵
  - Program crash
  PID:1992

memory/2028-55-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download