3818e9a04f5643d9da7118c6edb297513cd304adc659fc9230c7858029c88c41

Analysis

max time kernel
31s
max time network
35s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
08-07-2023 17:39

Target

94e3e88a3df970exeexeexeex.exe
Size

858KB
MD5

94e3e88a3df970a86d06f8728c41a7f2
SHA1

24c34b74788d5af99b8d359d6971e1b95d7e380e
SHA256

3818e9a04f5643d9da7118c6edb297513cd304adc659fc9230c7858029c88c41
SHA512

93519433fb2b0d797e41039bb895c4b5f43175e7ca8cd0efa2e9fd62a702e6fd8561279874458cb562cba912c587deebb1b0349befe3e4204fdd8a7b98d37ce5
SSDEEP

12288:AUwTmjXv91nN1V6KS/m3q6I881uzILuImCXT4dgVvgYsWX6PPdPLUUsC7V7+myA:AUwTuOKSnXDgYt+PhUXaIZA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3048	2320	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 3048	2320	94e3e88a3df970exeexeexeex.exe	29
PID 2320 wrote to memory of 3048	2320	94e3e88a3df970exeexeexeex.exe	29
PID 2320 wrote to memory of 3048	2320	94e3e88a3df970exeexeexeex.exe	29
PID 2320 wrote to memory of 3048	2320	94e3e88a3df970exeexeexeex.exe	29

C:\Users\Admin\AppData\Local\Temp\94e3e88a3df970exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\94e3e88a3df970exeexeexeex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 152
  2⤵
  - Program crash
  PID:3048