eb063a60c333e75d385f210af767eb9653c839e487d783c25f8b1661deea1402

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
17-08-2023 10:51

Target

eb063a60c333e75d385f210af767eb9653c839e487d783c25f8b1661deea1402.exe
Size

161KB
MD5

1bf2e7a3e91af22b4cdfd153b2f11cfc
SHA1

56d79beb2c551c8f2037910a7f69c6f29b2f9491
SHA256

eb063a60c333e75d385f210af767eb9653c839e487d783c25f8b1661deea1402
SHA512

29add75eaa08ba32a94d6e2fe1064dfcca8e15440ed22ad7a21b767b2a2a82036e3d54a3091c107aee1104983a9f1fff58e3fb28108dedb2fe4d09451ef33832
SSDEEP

3072:2Fzpn6a6ah+AjfgrtTFsYHdN8j6CAsp0MsRhbMbs0KN0Xs6M79/dBZ0rYWIt6I2G:2Ff+AjfgrtTFsYHdN8my0MsRFMbs05Xr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2112	1276	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 2112	1276	eb063a60c333e75d385f210af767eb9653c839e487d783c25f8b1661deea1402.exe	29
PID 1276 wrote to memory of 2112	1276	eb063a60c333e75d385f210af767eb9653c839e487d783c25f8b1661deea1402.exe	29
PID 1276 wrote to memory of 2112	1276	eb063a60c333e75d385f210af767eb9653c839e487d783c25f8b1661deea1402.exe	29

C:\Users\Admin\AppData\Local\Temp\eb063a60c333e75d385f210af767eb9653c839e487d783c25f8b1661deea1402.exe
"C:\Users\Admin\AppData\Local\Temp\eb063a60c333e75d385f210af767eb9653c839e487d783c25f8b1661deea1402.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1276 -s 36
  2⤵
  - Program crash
  PID:2112