eda44c544da0f8cdca68ccd01e9df2ec856d7102b7dc5e404f54e36225b17ac3

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
05-06-2023 06:57

Target

eda44c544da0f8cdca68ccd01e9df2ec856d7102b7dc5e404f54e36225b17ac3.exe
Size

128KB
MD5

6465f3d6ee52829f669398f89d5de56f
SHA1

7633597b02157490a1ebc4213b4fd20bdcfb4d3f
SHA256

eda44c544da0f8cdca68ccd01e9df2ec856d7102b7dc5e404f54e36225b17ac3
SHA512

f09e61764c6777ee4950425c46c3753f78a2ffd91a5e33cb9ada3249966f435654c1eee92fd21cfb69af722eb87965d011077b022127cbb309e3c0fb33739511
SSDEEP

1536:uQXDifbEmzTbIFTfJWI5X708J6oK8tmLyrehDfI3dVZIJcG9fbrGItE+6:uqDpmz3Vwo8J6B8N65SXZIJZ9fbJtJ6

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

316 1808 WerFault.exe eda44c544da0f8cdca68ccd01e9df2ec856d7102b7dc5e404f54e36225b17ac3.exe

pid	pid_target	process	target process
316	1808	WerFault.exe	eda44c544da0f8cdca68ccd01e9df2ec856d7102b7dc5e404f54e36225b17ac3.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

eda44c544da0f8cdca68ccd01e9df2ec856d7102b7dc5e404f54e36225b17ac3.exe

description	pid	process	target process
PID 1808 wrote to memory of 316	1808	eda44c544da0f8cdca68ccd01e9df2ec856d7102b7dc5e404f54e36225b17ac3.exe	WerFault.exe
PID 1808 wrote to memory of 316	1808	eda44c544da0f8cdca68ccd01e9df2ec856d7102b7dc5e404f54e36225b17ac3.exe	WerFault.exe
PID 1808 wrote to memory of 316	1808	eda44c544da0f8cdca68ccd01e9df2ec856d7102b7dc5e404f54e36225b17ac3.exe	WerFault.exe
PID 1808 wrote to memory of 316	1808	eda44c544da0f8cdca68ccd01e9df2ec856d7102b7dc5e404f54e36225b17ac3.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\eda44c544da0f8cdca68ccd01e9df2ec856d7102b7dc5e404f54e36225b17ac3.exe
"C:\Users\Admin\AppData\Local\Temp\eda44c544da0f8cdca68ccd01e9df2ec856d7102b7dc5e404f54e36225b17ac3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 132
2⤵
- Program crash
PID:316