ebe2ffaf3ce46b95941e8dc40d0843909219a5d100071225ed0fcc800b2a54b1

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30/12/2022, 11:06

Target

ebe2ffaf3ce46b95941e8dc40d0843909219a5d100071225ed0fcc800b2a54b1.exe
Size

88KB
MD5

840d7f2fdc767576db4330a68b1c6560
SHA1

a86df037f0b8fab7c3be74d038124a65d78b24e2
SHA256

ebe2ffaf3ce46b95941e8dc40d0843909219a5d100071225ed0fcc800b2a54b1
SHA512

6ff0e48a922d6cc3065dff7086e3768f610fcb2ef320609f315a6884d5051999938a8f63667a9bf71bb997d8ad52340f504b414b5272c604ea53e020255e07d2
SSDEEP

1536:Nb4/XWuTGim9RcUb0ecy1jpsd9xtKH9zOlk8IpaIL8G:RPLpsRtKdzAk8IpeG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1156	1604	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 1156	1604	ebe2ffaf3ce46b95941e8dc40d0843909219a5d100071225ed0fcc800b2a54b1.exe	27
PID 1604 wrote to memory of 1156	1604	ebe2ffaf3ce46b95941e8dc40d0843909219a5d100071225ed0fcc800b2a54b1.exe	27
PID 1604 wrote to memory of 1156	1604	ebe2ffaf3ce46b95941e8dc40d0843909219a5d100071225ed0fcc800b2a54b1.exe	27
PID 1604 wrote to memory of 1156	1604	ebe2ffaf3ce46b95941e8dc40d0843909219a5d100071225ed0fcc800b2a54b1.exe	27

C:\Users\Admin\AppData\Local\Temp\ebe2ffaf3ce46b95941e8dc40d0843909219a5d100071225ed0fcc800b2a54b1.exe
"C:\Users\Admin\AppData\Local\Temp\ebe2ffaf3ce46b95941e8dc40d0843909219a5d100071225ed0fcc800b2a54b1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 96
  2⤵
  - Program crash
  PID:1156