e2e7cc72bc5d7046056f1784e2b21f760359131dbb37329e880211cf28ee69d0

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-02-2023 19:23

Target

fea30b1b6cf409b3e29c703cea59f179f8c426d6.exe
Size

37KB
MD5

af72e06f3c672737077fd04a6cd44af1
SHA1

fea30b1b6cf409b3e29c703cea59f179f8c426d6
SHA256

e2e7cc72bc5d7046056f1784e2b21f760359131dbb37329e880211cf28ee69d0
SHA512

c33e555243abb294436331d269de134283c71d9f7ecd94b1e05e69c04a230d6a1653c1d9e7ad7abfa440df227ca3e1591194c53b71dec637bc103244d003264e
SSDEEP

768:YevzNw901TxGi+ZPc3XyvgQu9Et+mZqt5RYVMLvZO4v:zNwe1T4i+ZPoXyYQss++qtfYys

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1216	1812	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 1216	1812	fea30b1b6cf409b3e29c703cea59f179f8c426d6.exe	28
PID 1812 wrote to memory of 1216	1812	fea30b1b6cf409b3e29c703cea59f179f8c426d6.exe	28
PID 1812 wrote to memory of 1216	1812	fea30b1b6cf409b3e29c703cea59f179f8c426d6.exe	28

C:\Users\Admin\AppData\Local\Temp\fea30b1b6cf409b3e29c703cea59f179f8c426d6.exe
"C:\Users\Admin\AppData\Local\Temp\fea30b1b6cf409b3e29c703cea59f179f8c426d6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1812 -s 716
  2⤵
  - Program crash
  PID:1216

memory/1812-54-0x0000000000CD0000-0x0000000000CDE000-memory.dmp

Filesize
56KB

Download
memory/1812-55-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp

Filesize
8KB

Download