ecde25f0b10f82290ece5aba203b3ac1871988b8cc1d71bfb6e8673db56f09cf

Analysis

max time kernel
46s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07-12-2022 15:51

Target

1756-64-0x0000000000400000-0x000000000042F000-memory.exe
Size

188KB
MD5

89ee474ac54721037d4bee32e7632945
SHA1

6449f6bf558dae279d96bbfb10c20045fa18042c
SHA256

ecde25f0b10f82290ece5aba203b3ac1871988b8cc1d71bfb6e8673db56f09cf
SHA512

e2be720974b232e06f86b885e2f44a8470886658884304134e03b135d584d7e52521a639fe518e5e556da75da02ae47026f1c692f29285410ccf23581ccec456
SSDEEP

3072:MNSDnf27jj6EqwAhbe5UfqJWyV+4VMwVd6YU5GkkmCQEiyp1YUyfsZVGK:3YGEqwIvqrV2QdQ57VCQEvp1fVGK

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1932 1500 WerFault.exe 1756-64-0x0000000000400000-0x000000000042F000-memory.exe

pid	pid_target	process	target process
1932	1500	WerFault.exe	1756-64-0x0000000000400000-0x000000000042F000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1756-64-0x0000000000400000-0x000000000042F000-memory.exe

description	pid	process	target process
PID 1500 wrote to memory of 1932	1500	1756-64-0x0000000000400000-0x000000000042F000-memory.exe	WerFault.exe
PID 1500 wrote to memory of 1932	1500	1756-64-0x0000000000400000-0x000000000042F000-memory.exe	WerFault.exe
PID 1500 wrote to memory of 1932	1500	1756-64-0x0000000000400000-0x000000000042F000-memory.exe	WerFault.exe
PID 1500 wrote to memory of 1932	1500	1756-64-0x0000000000400000-0x000000000042F000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1756-64-0x0000000000400000-0x000000000042F000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1756-64-0x0000000000400000-0x000000000042F000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 36
2⤵
- Program crash
PID:1932