ef67c0c6556b01e2f0e0ac3fd69af2f0f6a7f55ef6702b84cabca457295bf525

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 15:48

Target

ef67c0c6556b01e2f0e0ac3fd69af2f0f6a7f55ef6702b84cabca457295bf525.exe
Size

11.6MB
MD5

0ee18046e29005af595571586e19b981
SHA1

0eff995089b854e79e6d27949b0594994a4f85ba
SHA256

ef67c0c6556b01e2f0e0ac3fd69af2f0f6a7f55ef6702b84cabca457295bf525
SHA512

96be17d0e73a5542842e83b909db4bd08178c1bbef4a508d571d683fff2a509f719ad8c04bef81ae77570361a1455ded3964b2be4496b8fc204f808c44307631
SSDEEP

196608:KBktD15bFaNCHnAtFucWdZJrk52cMjZ5rjWJV:qyFPEAcW/JyovPW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2200	1740	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2200	1740	ef67c0c6556b01e2f0e0ac3fd69af2f0f6a7f55ef6702b84cabca457295bf525.exe	28
PID 1740 wrote to memory of 2200	1740	ef67c0c6556b01e2f0e0ac3fd69af2f0f6a7f55ef6702b84cabca457295bf525.exe	28
PID 1740 wrote to memory of 2200	1740	ef67c0c6556b01e2f0e0ac3fd69af2f0f6a7f55ef6702b84cabca457295bf525.exe	28
PID 1740 wrote to memory of 2200	1740	ef67c0c6556b01e2f0e0ac3fd69af2f0f6a7f55ef6702b84cabca457295bf525.exe	28

C:\Users\Admin\AppData\Local\Temp\ef67c0c6556b01e2f0e0ac3fd69af2f0f6a7f55ef6702b84cabca457295bf525.exe
"C:\Users\Admin\AppData\Local\Temp\ef67c0c6556b01e2f0e0ac3fd69af2f0f6a7f55ef6702b84cabca457295bf525.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 200
  2⤵
  - Program crash
  PID:2200