f037ec8fd020a81f781f7754d9656f63e339a1ff3a1ff2f11034972effee1e43

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230824-en
resource tags

arch:x64arch:x86image:win7-20230824-enlocale:en-usos:windows7-x64system
submitted
27-08-2023 09:18

Target

f037ec8fd020a81f781f7754d9656f63e339a1ff3a1ff2f11034972effee1e43.exe
Size

2.8MB
MD5

15d55cdd3359963196741068a7ea0596
SHA1

9b6a61dfd5e75fc3a7b786cc127bae2e390e50f2
SHA256

f037ec8fd020a81f781f7754d9656f63e339a1ff3a1ff2f11034972effee1e43
SHA512

dac08d2a51c8a68bcca3766f639d2ebe4d4f7241a07262583dcadd4d0bc6cdbe25efe187a91df95321eefa02b35669dae3c7ef44730f3f8cd1d0bc810c208275
SSDEEP

49152:0pVExi03zDWi26fs2cWDAbclEdvqDM5OywR:0pVET0uDhGiQOywR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2020	2548	WerFault.exe	19

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2020	2548	f037ec8fd020a81f781f7754d9656f63e339a1ff3a1ff2f11034972effee1e43.exe	29
PID 2548 wrote to memory of 2020	2548	f037ec8fd020a81f781f7754d9656f63e339a1ff3a1ff2f11034972effee1e43.exe	29
PID 2548 wrote to memory of 2020	2548	f037ec8fd020a81f781f7754d9656f63e339a1ff3a1ff2f11034972effee1e43.exe	29
PID 2548 wrote to memory of 2020	2548	f037ec8fd020a81f781f7754d9656f63e339a1ff3a1ff2f11034972effee1e43.exe	29

C:\Users\Admin\AppData\Local\Temp\f037ec8fd020a81f781f7754d9656f63e339a1ff3a1ff2f11034972effee1e43.exe
"C:\Users\Admin\AppData\Local\Temp\f037ec8fd020a81f781f7754d9656f63e339a1ff3a1ff2f11034972effee1e43.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 204
  2⤵
  - Program crash
  PID:2020