c01e09f77f9290f0ee7959b9937dac398c21b0257052f90492d0f9496ec5ead4

Analysis

max time kernel
2s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 06:03

Target

c01e09f77f9290f0ee7959b9937dac398c21b0257052f90492d0f9496ec5ead4.exe
Size

150KB
MD5

b5a58ab9f71706219f6b3ef040a01004
SHA1

d71e3035dd1e891ec737920fedcce894da46ed67
SHA256

c01e09f77f9290f0ee7959b9937dac398c21b0257052f90492d0f9496ec5ead4
SHA512

a5f47636a3f46711edcb103987a0c4bd3b88333b600368ee72e1764d65179d1c046b1c12152469afe840a7a7f58e1c1d463d969ada3465f2297c2ec1e5b404e6
SSDEEP

3072:IfgxEi/sjRuAzmEIF13N86yRhC5YUn5K7fEQ:z6ZZz05i6yhkYjt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
940	1888	WerFault.exe	22

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 940	1888	c01e09f77f9290f0ee7959b9937dac398c21b0257052f90492d0f9496ec5ead4.exe	28
PID 1888 wrote to memory of 940	1888	c01e09f77f9290f0ee7959b9937dac398c21b0257052f90492d0f9496ec5ead4.exe	28
PID 1888 wrote to memory of 940	1888	c01e09f77f9290f0ee7959b9937dac398c21b0257052f90492d0f9496ec5ead4.exe	28
PID 1888 wrote to memory of 940	1888	c01e09f77f9290f0ee7959b9937dac398c21b0257052f90492d0f9496ec5ead4.exe	28

C:\Users\Admin\AppData\Local\Temp\c01e09f77f9290f0ee7959b9937dac398c21b0257052f90492d0f9496ec5ead4.exe
"C:\Users\Admin\AppData\Local\Temp\c01e09f77f9290f0ee7959b9937dac398c21b0257052f90492d0f9496ec5ead4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 120
  2⤵
  - Program crash
  PID:940

memory/1888-54-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download