ea199128218372010786bb9648cc7d19ebcc7111ed9afefa23231bc2f8f830fd

Analysis

max time kernel
290s
max time network
369s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 04:14

Target

ea199128218372010786bb9648cc7d19ebcc7111ed9afefa23231bc2f8f830fd.exe
Size

41KB
MD5

2f97a2ddff19f0822f94db7e0bb793c6
SHA1

78d0dc47c973f0c769d68f802e5a211e91ba30b7
SHA256

ea199128218372010786bb9648cc7d19ebcc7111ed9afefa23231bc2f8f830fd
SHA512

87ecfc1e56160202e012a594ac9a62402ea6c6117c5e1ffbd90ec537aab5d5ef48a9e09d658552f7125c880f98f350e17ff1653fcd0e57a166e592d89d0efca3
SSDEEP

768:dCGhM4+mgcpfYDAI1wivZMRRnvGnqIO6LaovHhUH/:dbKypfDkPvsnvGnqw+oSf

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1480	5016	WerFault.exe	79
1200	5016	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 1200	5016	ea199128218372010786bb9648cc7d19ebcc7111ed9afefa23231bc2f8f830fd.exe	84
PID 5016 wrote to memory of 1200	5016	ea199128218372010786bb9648cc7d19ebcc7111ed9afefa23231bc2f8f830fd.exe	84
PID 5016 wrote to memory of 1200	5016	ea199128218372010786bb9648cc7d19ebcc7111ed9afefa23231bc2f8f830fd.exe	84

C:\Users\Admin\AppData\Local\Temp\ea199128218372010786bb9648cc7d19ebcc7111ed9afefa23231bc2f8f830fd.exe
"C:\Users\Admin\AppData\Local\Temp\ea199128218372010786bb9648cc7d19ebcc7111ed9afefa23231bc2f8f830fd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 224
  2⤵
  - Program crash
  PID:1480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 224
  2⤵
  - Program crash
  PID:1200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5016 -ip 5016
1⤵
PID:1148