ecf61cc6b25b3b3f7eeeb209c42eac8edc8b8e008485774dcb9c19c7c84b9d1a

Analysis

max time kernel
329s
max time network
390s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 16:21

Target

ecf61cc6b25b3b3f7eeeb209c42eac8edc8b8e008485774dcb9c19c7c84b9d1a.exe
Size

305KB
MD5

ca0661075011895266cbbe90bb7e97c3
SHA1

597103c85b2172e26034fbcc68902d79b639d873
SHA256

ecf61cc6b25b3b3f7eeeb209c42eac8edc8b8e008485774dcb9c19c7c84b9d1a
SHA512

783a93120093768123f9c1af5feab39ddee1c9a8cab1aeb56f223f6074aa062ec2add377b10939fd6194bc2fc764950e7d18fb2f5ac08432b6c57fb65fb2a33b
SSDEEP

6144:dG+2lnHHnHrLrLLrLrDipQTVT5KYD4l/3JKoPUGlnDJuG855+Hg1Wms7pSr1CES:dFbKKw4lhKMnND8IyWms7psCES

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
364	4944	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 364	4944	ecf61cc6b25b3b3f7eeeb209c42eac8edc8b8e008485774dcb9c19c7c84b9d1a.exe	86
PID 4944 wrote to memory of 364	4944	ecf61cc6b25b3b3f7eeeb209c42eac8edc8b8e008485774dcb9c19c7c84b9d1a.exe	86
PID 4944 wrote to memory of 364	4944	ecf61cc6b25b3b3f7eeeb209c42eac8edc8b8e008485774dcb9c19c7c84b9d1a.exe	86

C:\Users\Admin\AppData\Local\Temp\ecf61cc6b25b3b3f7eeeb209c42eac8edc8b8e008485774dcb9c19c7c84b9d1a.exe
"C:\Users\Admin\AppData\Local\Temp\ecf61cc6b25b3b3f7eeeb209c42eac8edc8b8e008485774dcb9c19c7c84b9d1a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 524
  2⤵
  - Program crash
  PID:364