e5e9ff3263f0d934daebff3fa7ac9c3821a766617edda31f8816ae73767bda61

Analysis

max time kernel
168s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 05:54

Target

e5e9ff3263f0d934daebff3fa7ac9c3821a766617edda31f8816ae73767bda61.exe
Size

336KB
MD5

61bdf8c01c44221025e72bd263cb0d34
SHA1

afc7e3a01b9c5e5021e6034d19af70621605f47e
SHA256

e5e9ff3263f0d934daebff3fa7ac9c3821a766617edda31f8816ae73767bda61
SHA512

4d28c55b397825334b5722b7d4cc61dfddba7d29457b33b5aed0368e8b64905e2d1cb118c92220f6a82e7cfa81398906a0492d65b266e73f988a0f29a07ebbf7
SSDEEP

6144:6XbFxvfuAE8vlqKFbsBLGWLqvbO5RmEjb0qtU6GKrV:gvfu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1964	1776	WerFault.exe	19

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 1964	1776	e5e9ff3263f0d934daebff3fa7ac9c3821a766617edda31f8816ae73767bda61.exe	27
PID 1776 wrote to memory of 1964	1776	e5e9ff3263f0d934daebff3fa7ac9c3821a766617edda31f8816ae73767bda61.exe	27
PID 1776 wrote to memory of 1964	1776	e5e9ff3263f0d934daebff3fa7ac9c3821a766617edda31f8816ae73767bda61.exe	27
PID 1776 wrote to memory of 1964	1776	e5e9ff3263f0d934daebff3fa7ac9c3821a766617edda31f8816ae73767bda61.exe	27
PID 1776 wrote to memory of 1964	1776	e5e9ff3263f0d934daebff3fa7ac9c3821a766617edda31f8816ae73767bda61.exe	27
PID 1776 wrote to memory of 1964	1776	e5e9ff3263f0d934daebff3fa7ac9c3821a766617edda31f8816ae73767bda61.exe	27
PID 1776 wrote to memory of 1964	1776	e5e9ff3263f0d934daebff3fa7ac9c3821a766617edda31f8816ae73767bda61.exe	27

C:\Users\Admin\AppData\Local\Temp\e5e9ff3263f0d934daebff3fa7ac9c3821a766617edda31f8816ae73767bda61.exe
"C:\Users\Admin\AppData\Local\Temp\e5e9ff3263f0d934daebff3fa7ac9c3821a766617edda31f8816ae73767bda61.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 324
  2⤵
  - Program crash
  PID:1964

memory/1776-54-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download
memory/1776-55-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1776-57-0x0000000000170000-0x00000000001CA000-memory.dmp

Filesize
360KB

Download
memory/1776-58-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1964-56-0x0000000000000000-mapping.dmp

Download