e94ba275c966b7dd5481bd3ec27f791e8869b5b0db5dd52b4e1aedb4810273fa

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 00:06

Target

e94ba275c966b7dd5481bd3ec27f791e8869b5b0db5dd52b4e1aedb4810273fa.exe
Size

87KB
MD5

19cd6970668362e4d2896dd581c901ad
SHA1

0d20badf41464b415a1051f1702f768033bd995d
SHA256

e94ba275c966b7dd5481bd3ec27f791e8869b5b0db5dd52b4e1aedb4810273fa
SHA512

9ab99c5c348456acdecfabeff518daacab04731fc944c99e7ab2954951903d90707a3ef244a8ae5842bc2ef60b0c6e83a9370842f7849bc5e29f68294ad2ad89
SSDEEP

1536:aLyxFXdoypzNLMLont54ygGr8uqhkf7zCohTMw0SMSQaJ6fdu8:aL8FuypzaontSBxDmC8jj6a8fdt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1948	1444	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 1948	1444	e94ba275c966b7dd5481bd3ec27f791e8869b5b0db5dd52b4e1aedb4810273fa.exe	27
PID 1444 wrote to memory of 1948	1444	e94ba275c966b7dd5481bd3ec27f791e8869b5b0db5dd52b4e1aedb4810273fa.exe	27
PID 1444 wrote to memory of 1948	1444	e94ba275c966b7dd5481bd3ec27f791e8869b5b0db5dd52b4e1aedb4810273fa.exe	27
PID 1444 wrote to memory of 1948	1444	e94ba275c966b7dd5481bd3ec27f791e8869b5b0db5dd52b4e1aedb4810273fa.exe	27

C:\Users\Admin\AppData\Local\Temp\e94ba275c966b7dd5481bd3ec27f791e8869b5b0db5dd52b4e1aedb4810273fa.exe
"C:\Users\Admin\AppData\Local\Temp\e94ba275c966b7dd5481bd3ec27f791e8869b5b0db5dd52b4e1aedb4810273fa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 88
  2⤵
  - Program crash
  PID:1948

memory/1444-55-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download