e18387327b785e9f81e2ef1f6430063bf432be7cdfd0a348e08fc71331dbcf1c

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:30

Target

e18387327b785e9f81e2ef1f6430063bf432be7cdfd0a348e08fc71331dbcf1c.exe
Size

2.5MB
MD5

f02d5b2bd83e73412dc29996ce23640c
SHA1

70fab69fc08f9cac63457dbc3775b1f7bf8b3140
SHA256

e18387327b785e9f81e2ef1f6430063bf432be7cdfd0a348e08fc71331dbcf1c
SHA512

aa47c43405b3d7b8bc7833e12ec29f30c553fe745425a5260a67c3cbd02d3def6689242b90b8bcc1e7e8a3fd1ea6f063782e55acd26ab27d32d1cf7138e67e20
SSDEEP

49152:TRoVAqt9sWqNhngi/0LCVqwMlKM23iuUXUhV/t67c0xsEU9:TR+Ht9sW4hnNbVNmKM23nUXUhVDZEU

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2976 1048 WerFault.exe e18387327b785e9f81e2ef1f6430063bf432be7cdfd0a348e08fc71331dbcf1c.exe

pid	pid_target	process	target process
2976	1048	WerFault.exe	e18387327b785e9f81e2ef1f6430063bf432be7cdfd0a348e08fc71331dbcf1c.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e18387327b785e9f81e2ef1f6430063bf432be7cdfd0a348e08fc71331dbcf1c.exe

description	pid	process	target process
PID 1048 wrote to memory of 2976	1048	e18387327b785e9f81e2ef1f6430063bf432be7cdfd0a348e08fc71331dbcf1c.exe	WerFault.exe
PID 1048 wrote to memory of 2976	1048	e18387327b785e9f81e2ef1f6430063bf432be7cdfd0a348e08fc71331dbcf1c.exe	WerFault.exe
PID 1048 wrote to memory of 2976	1048	e18387327b785e9f81e2ef1f6430063bf432be7cdfd0a348e08fc71331dbcf1c.exe	WerFault.exe
PID 1048 wrote to memory of 2976	1048	e18387327b785e9f81e2ef1f6430063bf432be7cdfd0a348e08fc71331dbcf1c.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e18387327b785e9f81e2ef1f6430063bf432be7cdfd0a348e08fc71331dbcf1c.exe
"C:\Users\Admin\AppData\Local\Temp\e18387327b785e9f81e2ef1f6430063bf432be7cdfd0a348e08fc71331dbcf1c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 72
2⤵
- Program crash
PID:2976

memory/1048-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1048-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download