112f4dbae2deb599b618ee31e23d9d4f8a2af21ef5a5e2376d4c9d285511964e

Analysis

max time kernel
26s
max time network
31s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
08-07-2023 16:36

Target

64edf2969286d0exeexeexeex.exe
Size

335KB
MD5

64edf2969286d01fb3429c0217ae6a2b
SHA1

1d6988aab38241cfccc2e1b5aef2e756457b3277
SHA256

112f4dbae2deb599b618ee31e23d9d4f8a2af21ef5a5e2376d4c9d285511964e
SHA512

218135f2947543336eb6818fe9bdf5cef8b95d16b0dcf4caf941ab897d28256de95d16525d8c89d2a53a92e2c69b1de45af42c357c1676f1ad7019972af710de
SSDEEP

6144:qtUGfUWOeEBUEhLkXj3zRG6yLQ/UNP4H2CiTTp10qhh45Ajrt:qtUGfVwUFzRG6EQ0POfiTTf0qEAjrt

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2120 2216 WerFault.exe 64edf2969286d0exeexeexeex.exe

pid	pid_target	process	target process
2120	2216	WerFault.exe	64edf2969286d0exeexeexeex.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

64edf2969286d0exeexeexeex.exe

description	pid	process	target process
PID 2216 wrote to memory of 2120	2216	64edf2969286d0exeexeexeex.exe	WerFault.exe
PID 2216 wrote to memory of 2120	2216	64edf2969286d0exeexeexeex.exe	WerFault.exe
PID 2216 wrote to memory of 2120	2216	64edf2969286d0exeexeexeex.exe	WerFault.exe
PID 2216 wrote to memory of 2120	2216	64edf2969286d0exeexeexeex.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\64edf2969286d0exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\64edf2969286d0exeexeexeex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 120
2⤵
- Program crash
PID:2120