ebc4d1d7b579d181a60e150ee0cc921b8fd8432cd2304d7bc284a1507af068dd

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 03:11

Target

ebc4d1d7b579d181a60e150ee0cc921b8fd8432cd2304d7bc284a1507af068dd.exe
Size

51KB
MD5

21f235cbd73f1b7ab30d209131bed3b0
SHA1

5fdcd4cb1f29a7d41da9cc7ca08a535ab212c55b
SHA256

ebc4d1d7b579d181a60e150ee0cc921b8fd8432cd2304d7bc284a1507af068dd
SHA512

e4ccdff6ef51e3510b2ea7fa2dbbf7c64341f03464d975957414c4569baf9ae737d1d3cdaa5d55c8d22febd45bb7328c8b93861395dbe215c2dbd750c92e6bcb
SSDEEP

768:L+ozTJd151sWCOsku1nzucKM4kIAcTc1v2:SoPyKFkIAp1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
928	992	WerFault.exe	11

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 928	992	ebc4d1d7b579d181a60e150ee0cc921b8fd8432cd2304d7bc284a1507af068dd.exe	27
PID 992 wrote to memory of 928	992	ebc4d1d7b579d181a60e150ee0cc921b8fd8432cd2304d7bc284a1507af068dd.exe	27
PID 992 wrote to memory of 928	992	ebc4d1d7b579d181a60e150ee0cc921b8fd8432cd2304d7bc284a1507af068dd.exe	27
PID 992 wrote to memory of 928	992	ebc4d1d7b579d181a60e150ee0cc921b8fd8432cd2304d7bc284a1507af068dd.exe	27

C:\Users\Admin\AppData\Local\Temp\ebc4d1d7b579d181a60e150ee0cc921b8fd8432cd2304d7bc284a1507af068dd.exe
"C:\Users\Admin\AppData\Local\Temp\ebc4d1d7b579d181a60e150ee0cc921b8fd8432cd2304d7bc284a1507af068dd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 36
  2⤵
  - Program crash
  PID:928