ec24689dff54fe437fd554ea768f8dab33e6b448a8ddcf6b7aedd079ca435a15

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:33

Target

ec24689dff54fe437fd554ea768f8dab33e6b448a8ddcf6b7aedd079ca435a15.exe
Size

2.2MB
MD5

815968c1e37397cea2bdb59e495302e5
SHA1

5685534a64708ff79755b6567fb144f97582fbbe
SHA256

ec24689dff54fe437fd554ea768f8dab33e6b448a8ddcf6b7aedd079ca435a15
SHA512

b8ebc84c5165008161aa7aec8671754cac116f8d15e8fda087ed63b67dc75b0b4e40d76b4aba3d53a150f18ed1c3bdd00f7f1bc669533ee25cb9e630a9b37c95
SSDEEP

24576:Jkpxqh7TXAQAbg82Xbvue836blvPuA9xG0bTd2jBx024soFgXEqXw04Xw+z9jVQw:y0hXA282XKeCuiJ4soFgXEqXw0GV

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1988 1708 WerFault.exe ec24689dff54fe437fd554ea768f8dab33e6b448a8ddcf6b7aedd079ca435a15.exe

pid	pid_target	process	target process
1988	1708	WerFault.exe	ec24689dff54fe437fd554ea768f8dab33e6b448a8ddcf6b7aedd079ca435a15.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ec24689dff54fe437fd554ea768f8dab33e6b448a8ddcf6b7aedd079ca435a15.exe

description	pid	process	target process
PID 1708 wrote to memory of 1988	1708	ec24689dff54fe437fd554ea768f8dab33e6b448a8ddcf6b7aedd079ca435a15.exe	WerFault.exe
PID 1708 wrote to memory of 1988	1708	ec24689dff54fe437fd554ea768f8dab33e6b448a8ddcf6b7aedd079ca435a15.exe	WerFault.exe
PID 1708 wrote to memory of 1988	1708	ec24689dff54fe437fd554ea768f8dab33e6b448a8ddcf6b7aedd079ca435a15.exe	WerFault.exe
PID 1708 wrote to memory of 1988	1708	ec24689dff54fe437fd554ea768f8dab33e6b448a8ddcf6b7aedd079ca435a15.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ec24689dff54fe437fd554ea768f8dab33e6b448a8ddcf6b7aedd079ca435a15.exe
"C:\Users\Admin\AppData\Local\Temp\ec24689dff54fe437fd554ea768f8dab33e6b448a8ddcf6b7aedd079ca435a15.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 48
2⤵
- Program crash
PID:1988