95af1d1cfafb99c8c9671abffe2ecf7c0df8a7d1507d7a11de07ea951fb634e1

Analysis

max time kernel
75s
max time network
79s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
10-07-2023 17:41

Target

d59513da13379cexeexeexeex.exe
Size

335KB
MD5

d59513da13379cd4cbad05c6df389c64
SHA1

ff99efc5eba686016a88681fe091a1133bd3e29d
SHA256

95af1d1cfafb99c8c9671abffe2ecf7c0df8a7d1507d7a11de07ea951fb634e1
SHA512

19824a3131da96728bcc203fc9edc30760e895bf5846467100d756caeb76508964c92ef80e97afaa8e933932c208c3bb3c1e61c7f85242f9da76e4ef34e39956
SSDEEP

6144:qtUGfUWOeEBUEhLkXj3zRG6yLQ/UNP4H2CiTTl10qhh4LAjrt:qtUGfVwUFzRG6EQ0POfiTTb0qqAjrt

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2348 2148 WerFault.exe d59513da13379cexeexeexeex.exe

pid	pid_target	process	target process
2348	2148	WerFault.exe	d59513da13379cexeexeexeex.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

d59513da13379cexeexeexeex.exe

description	pid	process	target process
PID 2148 wrote to memory of 2348	2148	d59513da13379cexeexeexeex.exe	WerFault.exe
PID 2148 wrote to memory of 2348	2148	d59513da13379cexeexeexeex.exe	WerFault.exe
PID 2148 wrote to memory of 2348	2148	d59513da13379cexeexeexeex.exe	WerFault.exe
PID 2148 wrote to memory of 2348	2148	d59513da13379cexeexeexeex.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\d59513da13379cexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\d59513da13379cexeexeexeex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 120
2⤵
- Program crash
PID:2348