ed4105b51b5679bd792f4dc8843eacd6a5f3c8a12095c8c3b1afa4b38a56342f

Analysis

max time kernel
7s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 20:05

Target

ed4105b51b5679bd792f4dc8843eacd6a5f3c8a12095c8c3b1afa4b38a56342f.exe
Size

172KB
MD5

033c5a384fcc40db6ed32877cb68ddb0
SHA1

a2a27a0377ece08f13484346e1ede5ae4eedc42a
SHA256

ed4105b51b5679bd792f4dc8843eacd6a5f3c8a12095c8c3b1afa4b38a56342f
SHA512

ce2c272f5137c0e8b2434691c0a915773c495537caf8487198c9275161799b1b19b335f4128424cde6b77ca56a9f265a46af18b0da5de0a628dc64aa39314686
SSDEEP

3072:YnURL6GL7hxYDBmbB9Hrh253H0n8aRWpwRuc13f:GUhdlbE3H0n8EWpwZ1v

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1308	956	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 1308	956	ed4105b51b5679bd792f4dc8843eacd6a5f3c8a12095c8c3b1afa4b38a56342f.exe	28
PID 956 wrote to memory of 1308	956	ed4105b51b5679bd792f4dc8843eacd6a5f3c8a12095c8c3b1afa4b38a56342f.exe	28
PID 956 wrote to memory of 1308	956	ed4105b51b5679bd792f4dc8843eacd6a5f3c8a12095c8c3b1afa4b38a56342f.exe	28
PID 956 wrote to memory of 1308	956	ed4105b51b5679bd792f4dc8843eacd6a5f3c8a12095c8c3b1afa4b38a56342f.exe	28

C:\Users\Admin\AppData\Local\Temp\ed4105b51b5679bd792f4dc8843eacd6a5f3c8a12095c8c3b1afa4b38a56342f.exe
"C:\Users\Admin\AppData\Local\Temp\ed4105b51b5679bd792f4dc8843eacd6a5f3c8a12095c8c3b1afa4b38a56342f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 956 -s 148
  2⤵
  - Program crash
  PID:1308

memory/956-55-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1308-54-0x0000000000000000-mapping.dmp

Download