ef31fd3b4fae0d2316e27f8ca5dad8f1a02ff086583c045566e56abc8ada739d

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 04:32

Target

ef31fd3b4fae0d2316e27f8ca5dad8f1a02ff086583c045566e56abc8ada739d.exe
Size

5KB
MD5

2f0096525c35ae1f748f61be46c96781
SHA1

39a802e4f42c2329bd3d25d7a5b4d02502f27306
SHA256

ef31fd3b4fae0d2316e27f8ca5dad8f1a02ff086583c045566e56abc8ada739d
SHA512

384fbba7d8ecd838edd7d50e980baaf296c37adafde5dff16f8d80ef21aba047a9462c82d795eed8381a337f6be86959f34f2a22d11dd9d18c8b9dec136cc3b5
SSDEEP

48:SO7lXWFPpT+dXVfzZh4yMGcKzMEkTaak4PAZivO2pB42pBdvMZL2R7t+RuqSxp:F1WLkFfNnOKYloIQ2pm2pbYSixE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3052	1880	WerFault.exe	3

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 3052	1880	ef31fd3b4fae0d2316e27f8ca5dad8f1a02ff086583c045566e56abc8ada739d.exe	28
PID 1880 wrote to memory of 3052	1880	ef31fd3b4fae0d2316e27f8ca5dad8f1a02ff086583c045566e56abc8ada739d.exe	28
PID 1880 wrote to memory of 3052	1880	ef31fd3b4fae0d2316e27f8ca5dad8f1a02ff086583c045566e56abc8ada739d.exe	28
PID 1880 wrote to memory of 3052	1880	ef31fd3b4fae0d2316e27f8ca5dad8f1a02ff086583c045566e56abc8ada739d.exe	28

C:\Users\Admin\AppData\Local\Temp\ef31fd3b4fae0d2316e27f8ca5dad8f1a02ff086583c045566e56abc8ada739d.exe
"C:\Users\Admin\AppData\Local\Temp\ef31fd3b4fae0d2316e27f8ca5dad8f1a02ff086583c045566e56abc8ada739d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 48
  2⤵
  - Program crash
  PID:3052