3141e3c1d12d6f24a961896ce134773b1e8b6127d652ef1f5701143f32014634

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19-07-2023 14:43

Target

eed4ee9dcf9827exe_JC.exe
Size

2.9MB
MD5

eed4ee9dcf9827bf6f14cfcd6f8d3362
SHA1

b1cd56c5636cce11c69bacd0e4153f02ca75ebd5
SHA256

3141e3c1d12d6f24a961896ce134773b1e8b6127d652ef1f5701143f32014634
SHA512

b524d52dc0e1f6b058a535314ac08cfcf38b2da1288770a72825b4adea317b7bdc1190a44075074fbfffe8684eb81a0ebf6ae6a425563c0a6047e0c79f5f1102
SSDEEP

49152:bdFm/ICkbPBzS7ULCbGyDboE8wrupidLNDNVeC1T5nY5tHfswXNWoUr3EHDMYCpo:BFXpDBzS7UL+G3q5V7y5JB9WBUHIYCpk

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2356 2764 WerFault.exe eed4ee9dcf9827exe_JC.exe

pid	pid_target	process	target process
2356	2764	WerFault.exe	eed4ee9dcf9827exe_JC.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

eed4ee9dcf9827exe_JC.exe

description	pid	process	target process
PID 2764 wrote to memory of 2356	2764	eed4ee9dcf9827exe_JC.exe	WerFault.exe
PID 2764 wrote to memory of 2356	2764	eed4ee9dcf9827exe_JC.exe	WerFault.exe
PID 2764 wrote to memory of 2356	2764	eed4ee9dcf9827exe_JC.exe	WerFault.exe
PID 2764 wrote to memory of 2356	2764	eed4ee9dcf9827exe_JC.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\eed4ee9dcf9827exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\eed4ee9dcf9827exe_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 120
2⤵
- Program crash
PID:2356