e0680669a1540e45ba2a689bdb74fe4181fd105292f415d887815fbaa4aeab21

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
20-09-2023 03:36

Target

e0680669a1540e45ba2a689bdb74fe4181fd105292f415d887815fbaa4aeab21.exe
Size

922KB
MD5

6576868574ece270c32f991de3f3504e
SHA1

50df4ae450e19f34c8ff23181cee4d2bb854a2ec
SHA256

e0680669a1540e45ba2a689bdb74fe4181fd105292f415d887815fbaa4aeab21
SHA512

47aa1838e5dae3ff17fccfd23cf8053ad3c254adc4993ced35863c3f55783b5f45a672dbd5993de22bf0f3039b2480144da4f208fa0bfa8adfd11b5f7682b560
SSDEEP

12288:i1si2x2dAVuu9i4ytnnp1gZVfk5TjzujkYb4gIubL4nRJVsdLCAA:gsiA2dAV99i4ytyVM3CqjAA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2480	2092	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2480	2092	e0680669a1540e45ba2a689bdb74fe4181fd105292f415d887815fbaa4aeab21.exe	29
PID 2092 wrote to memory of 2480	2092	e0680669a1540e45ba2a689bdb74fe4181fd105292f415d887815fbaa4aeab21.exe	29
PID 2092 wrote to memory of 2480	2092	e0680669a1540e45ba2a689bdb74fe4181fd105292f415d887815fbaa4aeab21.exe	29
PID 2092 wrote to memory of 2480	2092	e0680669a1540e45ba2a689bdb74fe4181fd105292f415d887815fbaa4aeab21.exe	29

C:\Users\Admin\AppData\Local\Temp\e0680669a1540e45ba2a689bdb74fe4181fd105292f415d887815fbaa4aeab21.exe
"C:\Users\Admin\AppData\Local\Temp\e0680669a1540e45ba2a689bdb74fe4181fd105292f415d887815fbaa4aeab21.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 36
  2⤵
  - Program crash
  PID:2480