ed6d973aa96147a3cfa6c8e09e70e62d896ddae3e69a0710bb3ff51702260de2

Analysis

max time kernel
234s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 21:28

Target

ed6d973aa96147a3cfa6c8e09e70e62d896ddae3e69a0710bb3ff51702260de2.exe
Size

106KB
MD5

7e2f5ae305a601ff7bf698f1cfc0167a
SHA1

abcb41a8f01fb3b6affdbc15bb6eee14abbbcb57
SHA256

ed6d973aa96147a3cfa6c8e09e70e62d896ddae3e69a0710bb3ff51702260de2
SHA512

c8c389dbaa76c93dcc193d0a22cce05ad08cd6fab0d4369de7ab44cbc915b9633d047db6e591bbaef056a0971bbd1ef8b92e2740de1e5418e34230fb8c5a4b64
SSDEEP

1536:S+FDoKtniY1u7Nn2JFkC2styJjCKICFjC7EWisS+5mlatSfkZ:S+FDzK71QkbstyJjCKICpC72s/mlaX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
520	512	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 512 wrote to memory of 520	512	ed6d973aa96147a3cfa6c8e09e70e62d896ddae3e69a0710bb3ff51702260de2.exe	28
PID 512 wrote to memory of 520	512	ed6d973aa96147a3cfa6c8e09e70e62d896ddae3e69a0710bb3ff51702260de2.exe	28
PID 512 wrote to memory of 520	512	ed6d973aa96147a3cfa6c8e09e70e62d896ddae3e69a0710bb3ff51702260de2.exe	28
PID 512 wrote to memory of 520	512	ed6d973aa96147a3cfa6c8e09e70e62d896ddae3e69a0710bb3ff51702260de2.exe	28

C:\Users\Admin\AppData\Local\Temp\ed6d973aa96147a3cfa6c8e09e70e62d896ddae3e69a0710bb3ff51702260de2.exe
"C:\Users\Admin\AppData\Local\Temp\ed6d973aa96147a3cfa6c8e09e70e62d896ddae3e69a0710bb3ff51702260de2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 128
  2⤵
  - Program crash
  PID:520

memory/512-55-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download