eaf973bb8765b63345ae80e8d18479717baa4d738a906e78e46e9b2275521517

Analysis

max time kernel
248s
max time network
337s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 03:13

Target

eaf973bb8765b63345ae80e8d18479717baa4d738a906e78e46e9b2275521517.exe
Size

259KB
MD5

e3a7c6510daad511bdd8c54886d94bc6
SHA1

84488a938999193205d0c2b800dd1b3e948631c0
SHA256

eaf973bb8765b63345ae80e8d18479717baa4d738a906e78e46e9b2275521517
SHA512

3182437fc5526a5f3317154cabae69289ad6bb3741eac259c8c748f1e53e14077cc495f802ac47c0a769861dad796aa04ababdeb3f7d72aee6800b703e53b4a7
SSDEEP

6144:jOTeHI8HiL7+f5O/WeEmqDDN/fQj45DvwT:WeoGiLaqPED3N/Ij4dwT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1868	560	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 1868	560	eaf973bb8765b63345ae80e8d18479717baa4d738a906e78e46e9b2275521517.exe	28
PID 560 wrote to memory of 1868	560	eaf973bb8765b63345ae80e8d18479717baa4d738a906e78e46e9b2275521517.exe	28
PID 560 wrote to memory of 1868	560	eaf973bb8765b63345ae80e8d18479717baa4d738a906e78e46e9b2275521517.exe	28
PID 560 wrote to memory of 1868	560	eaf973bb8765b63345ae80e8d18479717baa4d738a906e78e46e9b2275521517.exe	28

C:\Users\Admin\AppData\Local\Temp\eaf973bb8765b63345ae80e8d18479717baa4d738a906e78e46e9b2275521517.exe
"C:\Users\Admin\AppData\Local\Temp\eaf973bb8765b63345ae80e8d18479717baa4d738a906e78e46e9b2275521517.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 172
  2⤵
  - Program crash
  PID:1868

memory/560-54-0x0000000075C11000-0x0000000075C13000-memory.dmp

Filesize
8KB

Download
memory/560-56-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1868-55-0x0000000000000000-mapping.dmp

Download