eb794ea74e0961c7c6fa9ea2fb6144fde2dc760d98d1ed6727b544a7f944dd64

Analysis

max time kernel
39s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 17:02

Target

eb794ea74e0961c7c6fa9ea2fb6144fde2dc760d98d1ed6727b544a7f944dd64.exe
Size

111KB
MD5

c74a46c69f4acbe70665077e346fb934
SHA1

7be382f00fd60a22b68b0c89ef10f59be7166bd9
SHA256

eb794ea74e0961c7c6fa9ea2fb6144fde2dc760d98d1ed6727b544a7f944dd64
SHA512

020a200b7fb9333d156755f675dc9adf9cab499685d27d8e99309daac2fb9299769e0148d026456e741b7c5b64db307b5565896d99a195cab7a62685e6ddcd4e
SSDEEP

24:e1GStQ1Krra7lQtwAqOLxpsKxOGbXWKulYzM9VNNEsatb45Y3ZgPNR:StLO7StwwtpsQFz8+YXXEVb45mi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1088	896	WerFault.exe	20

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 1088	896	eb794ea74e0961c7c6fa9ea2fb6144fde2dc760d98d1ed6727b544a7f944dd64.exe	28
PID 896 wrote to memory of 1088	896	eb794ea74e0961c7c6fa9ea2fb6144fde2dc760d98d1ed6727b544a7f944dd64.exe	28
PID 896 wrote to memory of 1088	896	eb794ea74e0961c7c6fa9ea2fb6144fde2dc760d98d1ed6727b544a7f944dd64.exe	28
PID 896 wrote to memory of 1088	896	eb794ea74e0961c7c6fa9ea2fb6144fde2dc760d98d1ed6727b544a7f944dd64.exe	28

C:\Users\Admin\AppData\Local\Temp\eb794ea74e0961c7c6fa9ea2fb6144fde2dc760d98d1ed6727b544a7f944dd64.exe
"C:\Users\Admin\AppData\Local\Temp\eb794ea74e0961c7c6fa9ea2fb6144fde2dc760d98d1ed6727b544a7f944dd64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 896 -s 36
  2⤵
  - Program crash
  PID:1088