ea3e1a3d3cd6bb8fa5e84a6ca45fb1211a93efb60a2bba1ae49920f80e60e664

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 12:44

Target

ea3e1a3d3cd6bb8fa5e84a6ca45fb1211a93efb60a2bba1ae49920f80e60e664.exe
Size

112KB
MD5

543b4bbab52e5dbd186b4ed637044a56
SHA1

114296cde83c6c179d22a178a5b7e2dfa3127743
SHA256

ea3e1a3d3cd6bb8fa5e84a6ca45fb1211a93efb60a2bba1ae49920f80e60e664
SHA512

90bb0a7f914bb4cf5265d08291312d1affa59a11ed900f742936032b6186d07077469c0e06b95c3a071c7292b80bed189d965e977a56ae867d4ab221861ac59f
SSDEEP

1536:vDjggwW2tU39OEhR0hJpUcd6sNROrrEHmnjOItNOBVwz/U5pqHn5fG1GE6FQ+DQ+:vDjVoUtRcVUc+3ptNOD05fbDddX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1728	1084	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 1728	1084	ea3e1a3d3cd6bb8fa5e84a6ca45fb1211a93efb60a2bba1ae49920f80e60e664.exe	27
PID 1084 wrote to memory of 1728	1084	ea3e1a3d3cd6bb8fa5e84a6ca45fb1211a93efb60a2bba1ae49920f80e60e664.exe	27
PID 1084 wrote to memory of 1728	1084	ea3e1a3d3cd6bb8fa5e84a6ca45fb1211a93efb60a2bba1ae49920f80e60e664.exe	27
PID 1084 wrote to memory of 1728	1084	ea3e1a3d3cd6bb8fa5e84a6ca45fb1211a93efb60a2bba1ae49920f80e60e664.exe	27

C:\Users\Admin\AppData\Local\Temp\ea3e1a3d3cd6bb8fa5e84a6ca45fb1211a93efb60a2bba1ae49920f80e60e664.exe
"C:\Users\Admin\AppData\Local\Temp\ea3e1a3d3cd6bb8fa5e84a6ca45fb1211a93efb60a2bba1ae49920f80e60e664.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1084 -s 92
  2⤵
  - Program crash
  PID:1728