0688ba7056b1a00d52b68538fec4a400d80682c9f7effcfb9f9ece4ba1f145f5

Analysis

max time kernel
28s
max time network
32s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
08-07-2023 18:10

Target

7fc1a1424a146aexeexeexeex.exe
Size

335KB
MD5

7fc1a1424a146a3628eb19eaca291563
SHA1

b4f163d7da75f413fca660cc1ec48b5c4c654262
SHA256

0688ba7056b1a00d52b68538fec4a400d80682c9f7effcfb9f9ece4ba1f145f5
SHA512

bbe8aa88d868a3683bee1bd759a0dd1f369281a7c3592fcb5adabb05da6844460ac0a84e25709eb48db658a634b9b081cbe4d443cca843d202255c4846cc35f5
SSDEEP

6144:qtUGfUWOeEBUEhLkXj3zRG6yLQ/UNP4H2CiTTE10qhh4QAjrt:qtUGfVwUFzRG6EQ0POfiTTE0qFAjrt

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3040 996 WerFault.exe 7fc1a1424a146aexeexeexeex.exe

pid	pid_target	process	target process
3040	996	WerFault.exe	7fc1a1424a146aexeexeexeex.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7fc1a1424a146aexeexeexeex.exe

description	pid	process	target process
PID 996 wrote to memory of 3040	996	7fc1a1424a146aexeexeexeex.exe	WerFault.exe
PID 996 wrote to memory of 3040	996	7fc1a1424a146aexeexeexeex.exe	WerFault.exe
PID 996 wrote to memory of 3040	996	7fc1a1424a146aexeexeexeex.exe	WerFault.exe
PID 996 wrote to memory of 3040	996	7fc1a1424a146aexeexeexeex.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7fc1a1424a146aexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\7fc1a1424a146aexeexeexeex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 996 -s 120
2⤵
- Program crash
PID:3040