e61022df2abc3b1b8157a04d9fb24dc555a2df7acffa5628e71d945a38acce1b

Analysis

max time kernel
40s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 20:12

Target

e61022df2abc3b1b8157a04d9fb24dc555a2df7acffa5628e71d945a38acce1b.exe
Size

64KB
MD5

ef5fcb63216f8007eecd93b09364fcdc
SHA1

d56ee98fc122bc58d6c9cf5ccf5e73c145c8bf3d
SHA256

e61022df2abc3b1b8157a04d9fb24dc555a2df7acffa5628e71d945a38acce1b
SHA512

30d0a6f6789d107a6c06cec4f797c9d999c7095ca12bc9436ff2d2c69a7ca2e09afd1676da8c02ec7384f6d58d8ffd81d19e9f1a97be89a97459f9b833b04ac5
SSDEEP

1536:croWtPdPosz4fSb8OkGy5BCvXaI3HS8hP3iUmi+d:EdFQsUfBUQIvXPH/Prk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1176	1704	WerFault.exe	2

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1176	1704	e61022df2abc3b1b8157a04d9fb24dc555a2df7acffa5628e71d945a38acce1b.exe	27
PID 1704 wrote to memory of 1176	1704	e61022df2abc3b1b8157a04d9fb24dc555a2df7acffa5628e71d945a38acce1b.exe	27
PID 1704 wrote to memory of 1176	1704	e61022df2abc3b1b8157a04d9fb24dc555a2df7acffa5628e71d945a38acce1b.exe	27
PID 1704 wrote to memory of 1176	1704	e61022df2abc3b1b8157a04d9fb24dc555a2df7acffa5628e71d945a38acce1b.exe	27

C:\Users\Admin\AppData\Local\Temp\e61022df2abc3b1b8157a04d9fb24dc555a2df7acffa5628e71d945a38acce1b.exe
"C:\Users\Admin\AppData\Local\Temp\e61022df2abc3b1b8157a04d9fb24dc555a2df7acffa5628e71d945a38acce1b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 36
  2⤵
  - Program crash
  PID:1176

memory/1704-55-0x00000000009C0000-0x00000000009E8000-memory.dmp

Filesize
160KB

Download