2ee0cef5a06ce20d0f511178d2b588ba1117ba45406df788a06a940c83f3f0d3

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 10:48

Target

2ee0cef5a06ce20d0f511178d2b588ba1117ba45406df788a06a940c83f3f0d3.exe
Size

1.3MB
MD5

c2cf4912b15897bbc710cf0fefe1c135
SHA1

6dabbb0bd4622068452f148253f6dafd309a15f7
SHA256

2ee0cef5a06ce20d0f511178d2b588ba1117ba45406df788a06a940c83f3f0d3
SHA512

caa62e4252b1aa26ba9946e29d12d48eb938fc904f432d11bcfb991a8ebd22b37e8d94ef9600849f732bd4f996e68fc9473b4cdc6c945920c51e9f6c1a01c99c
SSDEEP

24576:AP+g7Wy3xfMZKdcKtTjbJ44EEEEEEEEEEEEEEEEEEEETKKKKKKKKKKKKKKKKKKK7:A/iy3g6TjbrEEEEEEEEEEEEEEEEEEEE+

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2496 1728 WerFault.exe 2ee0cef5a06ce20d0f511178d2b588ba1117ba45406df788a06a940c83f3f0d3.exe

pid	pid_target	process	target process
2496	1728	WerFault.exe	2ee0cef5a06ce20d0f511178d2b588ba1117ba45406df788a06a940c83f3f0d3.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2ee0cef5a06ce20d0f511178d2b588ba1117ba45406df788a06a940c83f3f0d3.exe

description	pid	process	target process
PID 1728 wrote to memory of 2496	1728	2ee0cef5a06ce20d0f511178d2b588ba1117ba45406df788a06a940c83f3f0d3.exe	WerFault.exe
PID 1728 wrote to memory of 2496	1728	2ee0cef5a06ce20d0f511178d2b588ba1117ba45406df788a06a940c83f3f0d3.exe	WerFault.exe
PID 1728 wrote to memory of 2496	1728	2ee0cef5a06ce20d0f511178d2b588ba1117ba45406df788a06a940c83f3f0d3.exe	WerFault.exe
PID 1728 wrote to memory of 2496	1728	2ee0cef5a06ce20d0f511178d2b588ba1117ba45406df788a06a940c83f3f0d3.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2ee0cef5a06ce20d0f511178d2b588ba1117ba45406df788a06a940c83f3f0d3.exe
"C:\Users\Admin\AppData\Local\Temp\2ee0cef5a06ce20d0f511178d2b588ba1117ba45406df788a06a940c83f3f0d3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 676
2⤵
- Program crash
PID:2496

memory/1728-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1728-1-0x0000000000400000-0x000000000055C000-memory.dmp

Filesize
1.4MB

Download