e92b1ef9b01b8a637e9bc8c11553a1032eed49fa5353263761e61b0b96073530

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 11:49

Target

e92b1ef9b01b8a637e9bc8c11553a1032eed49fa5353263761e61b0b96073530.exe
Size

2.5MB
MD5

0db1bfb2573f21e4b84ace51fa3cc38c
SHA1

8d443efb800de1312ae981ed2309fd3e9e3abf3f
SHA256

e92b1ef9b01b8a637e9bc8c11553a1032eed49fa5353263761e61b0b96073530
SHA512

26c4da6bee8ecd546a986d7f39902e46cb981327af3f8c8d762876768eac71624fb623d97ddafdcc47e6c9ae69f1362fa5e1db5ac4d8fc662a6577b6e3e35656
SSDEEP

49152:Wn3ShVTVeLgerUmFfQYbHDHo8ygCSIPC3nXJ0J:WihVBer9FrfULS3XXJ0J

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1496	1964	WerFault.exe	27

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1340	1964	e92b1ef9b01b8a637e9bc8c11553a1032eed49fa5353263761e61b0b96073530.exe	28
PID 1964 wrote to memory of 1340	1964	e92b1ef9b01b8a637e9bc8c11553a1032eed49fa5353263761e61b0b96073530.exe	28
PID 1964 wrote to memory of 1340	1964	e92b1ef9b01b8a637e9bc8c11553a1032eed49fa5353263761e61b0b96073530.exe	28
PID 1964 wrote to memory of 1340	1964	e92b1ef9b01b8a637e9bc8c11553a1032eed49fa5353263761e61b0b96073530.exe	28
PID 1964 wrote to memory of 1496	1964	e92b1ef9b01b8a637e9bc8c11553a1032eed49fa5353263761e61b0b96073530.exe	29
PID 1964 wrote to memory of 1496	1964	e92b1ef9b01b8a637e9bc8c11553a1032eed49fa5353263761e61b0b96073530.exe	29
PID 1964 wrote to memory of 1496	1964	e92b1ef9b01b8a637e9bc8c11553a1032eed49fa5353263761e61b0b96073530.exe	29
PID 1964 wrote to memory of 1496	1964	e92b1ef9b01b8a637e9bc8c11553a1032eed49fa5353263761e61b0b96073530.exe	29

C:\Users\Admin\AppData\Local\Temp\e92b1ef9b01b8a637e9bc8c11553a1032eed49fa5353263761e61b0b96073530.exe
"C:\Users\Admin\AppData\Local\Temp\e92b1ef9b01b8a637e9bc8c11553a1032eed49fa5353263761e61b0b96073530.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\e92b1ef9b01b8a637e9bc8c11553a1032eed49fa5353263761e61b0b96073530.exe
  C:\Users\Admin\AppData\Local\Temp\e92b1ef9b01b8a637e9bc8c11553a1032eed49fa5353263761e61b0b96073530.exe
  2⤵
  PID:1340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 332
  2⤵
  - Program crash
  PID:1496

memory/1964-54-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/1964-55-0x00000000006A0000-0x0000000000777000-memory.dmp

Filesize
860KB

Download
memory/1964-57-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download