e1b5a3e6b73bc576377050dda38b0ab0d07ecacaa3198f9ac882bb0b6e0cb74c

Analysis

max time kernel
27s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 13:45

Target

e1b5a3e6b73bc576377050dda38b0ab0d07ecacaa3198f9ac882bb0b6e0cb74c.exe
Size

524KB
MD5

30d9a25cab9326fe6846ff3451cbcbd8
SHA1

b77d7a1f440aa4ba1ca8548bef7f722ef43ef140
SHA256

e1b5a3e6b73bc576377050dda38b0ab0d07ecacaa3198f9ac882bb0b6e0cb74c
SHA512

1be6701db9385a3be8ed3ea2a80820300f15a63fd200ef1f11c10b2287ca4d03824cc943c23e8ce2c4183924f9f7d3ea5c2fb9da1719ecb8007b1225af162a3a
SSDEEP

6144:XMwvvQSTEEnGDWAsNrlAAM5znH/cmBfn9EpZQMP87JxCXmt3MYvJ:XDv9lnvXL+rvBf4ZQ791M0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
976	960	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 976	960	e1b5a3e6b73bc576377050dda38b0ab0d07ecacaa3198f9ac882bb0b6e0cb74c.exe	28
PID 960 wrote to memory of 976	960	e1b5a3e6b73bc576377050dda38b0ab0d07ecacaa3198f9ac882bb0b6e0cb74c.exe	28
PID 960 wrote to memory of 976	960	e1b5a3e6b73bc576377050dda38b0ab0d07ecacaa3198f9ac882bb0b6e0cb74c.exe	28
PID 960 wrote to memory of 976	960	e1b5a3e6b73bc576377050dda38b0ab0d07ecacaa3198f9ac882bb0b6e0cb74c.exe	28

C:\Users\Admin\AppData\Local\Temp\e1b5a3e6b73bc576377050dda38b0ab0d07ecacaa3198f9ac882bb0b6e0cb74c.exe
"C:\Users\Admin\AppData\Local\Temp\e1b5a3e6b73bc576377050dda38b0ab0d07ecacaa3198f9ac882bb0b6e0cb74c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 176
  2⤵
  - Program crash
  PID:976