5e21391ba216a5d46e11789e4618fadfc37d54b2b32a12c6eb758da147a3b421

Analysis

max time kernel
28s
max time network
32s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
08-07-2023 20:27

Target

78b309bb8f8aa1exeexeexeex.exe
Size

335KB
MD5

78b309bb8f8aa16ad5c1870075253cbd
SHA1

f734a99799b37c33946b50e866f33673dbd3fb00
SHA256

5e21391ba216a5d46e11789e4618fadfc37d54b2b32a12c6eb758da147a3b421
SHA512

e7914756e675e1599672a832980c4322b60127ec84e59b33dd62e6c3a81599f03747f247294ab941f9ba7d8375aad8ae3ba224de5f887ec4bb2ecca77afb2d63
SSDEEP

6144:qtUGfUWOeEBUEhLkXj3zRG6yLQ/UNP4H2CiTTK10qhh49Ajrt:qtUGfVwUFzRG6EQ0POfiTTC0qUAjrt

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2300 2416 WerFault.exe 78b309bb8f8aa1exeexeexeex.exe

pid	pid_target	process	target process
2300	2416	WerFault.exe	78b309bb8f8aa1exeexeexeex.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

78b309bb8f8aa1exeexeexeex.exe

description	pid	process	target process
PID 2416 wrote to memory of 2300	2416	78b309bb8f8aa1exeexeexeex.exe	WerFault.exe
PID 2416 wrote to memory of 2300	2416	78b309bb8f8aa1exeexeexeex.exe	WerFault.exe
PID 2416 wrote to memory of 2300	2416	78b309bb8f8aa1exeexeexeex.exe	WerFault.exe
PID 2416 wrote to memory of 2300	2416	78b309bb8f8aa1exeexeexeex.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\78b309bb8f8aa1exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\78b309bb8f8aa1exeexeexeex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 120
2⤵
- Program crash
PID:2300