e626513a9136b0c13bd5419d2dedc9fa64bd240917a092f18d3a374d66105204

Analysis

max time kernel
40s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 09:07

Target

e626513a9136b0c13bd5419d2dedc9fa64bd240917a092f18d3a374d66105204.exe
Size

248KB
MD5

361b12716f1d8c7a4f4bdb450a948a60
SHA1

48781a0311e530e2b3133876a931da9db6e79c4e
SHA256

e626513a9136b0c13bd5419d2dedc9fa64bd240917a092f18d3a374d66105204
SHA512

4deebabf9faaca9440a66293dba00a20b4213a433fa76a56b2ce6d62db8ceb47b1aa23d1b1bb12deddffddf263f6f4087801a4fe5f687f964c83d674d89a0b8b
SSDEEP

3072:RqeiVD+EmUSLOUprPcbp9NLteiVD+EmU4H4zCTXG2ipYWQKS1vJYh3HBhNfsFM:RwViEtem3ViEt4HccXG2aYWs7YhxUa

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1108	904	WerFault.exe	8

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 1108	904	e626513a9136b0c13bd5419d2dedc9fa64bd240917a092f18d3a374d66105204.exe	28
PID 904 wrote to memory of 1108	904	e626513a9136b0c13bd5419d2dedc9fa64bd240917a092f18d3a374d66105204.exe	28
PID 904 wrote to memory of 1108	904	e626513a9136b0c13bd5419d2dedc9fa64bd240917a092f18d3a374d66105204.exe	28
PID 904 wrote to memory of 1108	904	e626513a9136b0c13bd5419d2dedc9fa64bd240917a092f18d3a374d66105204.exe	28

C:\Users\Admin\AppData\Local\Temp\e626513a9136b0c13bd5419d2dedc9fa64bd240917a092f18d3a374d66105204.exe
"C:\Users\Admin\AppData\Local\Temp\e626513a9136b0c13bd5419d2dedc9fa64bd240917a092f18d3a374d66105204.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 148
  2⤵
  - Program crash
  PID:1108

memory/904-55-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download