4c3643fcbf1945ce1544ed045f4979664b26869dd1aa5b9ce2965895d0b164d8

Analysis

max time kernel
82s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
10/02/2023, 08:24

Target

Device/HarddiskVolume3/Users/GemaPerezLGC/AppData/Roaming/0install.net/desktop-integration/stubs/1ea.exe
Size

111KB
MD5

999c037cac314f87a66c7833311c6049
SHA1

e4b2a3b9fe782d91ef259ef7b5f0bfeda5e7f34e
SHA256

1fa13a1b988d9d49a9a02daef6ef039e359bdc78b41a30aada5773eaf4465c2d
SHA512

dfbaf006fee7b34e8b43a8cb4f433f9df3dff93af6ebd902452b257c2529a9dea42f87cecc9142f6f1c92455b0cc0fc9245d9a1252d3e9e2e276ad3a1fda0432
SSDEEP

384:Fyd6V4TJZVhmuts+b92XSLJQEfnyWkTNKRwMF5cVKPwNU/a+:Fy0KjJsU6QJQEfnyWkWwMFIkfS+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
996	2036	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 996	2036	1ea.exe	28
PID 2036 wrote to memory of 996	2036	1ea.exe	28
PID 2036 wrote to memory of 996	2036	1ea.exe	28

C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume3\Users\GemaPerezLGC\AppData\Roaming\0install.net\desktop-integration\stubs\1ea.exe
"C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume3\Users\GemaPerezLGC\AppData\Roaming\0install.net\desktop-integration\stubs\1ea.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2036 -s 516
  2⤵
  - Program crash
  PID:996

memory/2036-54-0x0000000000BB0000-0x0000000000BD2000-memory.dmp

Filesize
136KB

Download