866c0294731f195b0b9efa4f9b7cac352e8de5121f63a458a75efed3a625d24a

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 21:46

Target

easfawefawfas.exe
Size

12KB
MD5

2813b6e3ed4bd6b14c53e3dffcdff21d
SHA1

5ac7c7a3dadde70f94810c608a2eb275f14b7bde
SHA256

866c0294731f195b0b9efa4f9b7cac352e8de5121f63a458a75efed3a625d24a
SHA512

ff2454992a5fbe5c8cfab149ebd5edaa089ab4f25b88a47c5da0348575a72f1de372c8e762f74f284070a7a2e1209202ca755b4c08dd99799ac5bb9a598e0a24
SSDEEP

192:LsNqFnJvOXdub8t6QP+TXVKTl1hAKje2Ecp0Gun8JZcxZQF:LsNvuI6QIKTHhA8rt0nnicxo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1812	1988	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 1812	1988	easfawefawfas.exe	28
PID 1988 wrote to memory of 1812	1988	easfawefawfas.exe	28
PID 1988 wrote to memory of 1812	1988	easfawefawfas.exe	28
PID 1988 wrote to memory of 1812	1988	easfawefawfas.exe	28

C:\Users\Admin\AppData\Local\Temp\easfawefawfas.exe
"C:\Users\Admin\AppData\Local\Temp\easfawefawfas.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 592
  2⤵
  - Program crash
  PID:1812

memory/1988-0-0x00000000745DE000-0x00000000745DF000-memory.dmp

Filesize
4KB

Download
memory/1988-1-0x0000000000970000-0x000000000097C000-memory.dmp

Filesize
48KB

Download
memory/1988-2-0x0000000000370000-0x000000000038A000-memory.dmp

Filesize
104KB

Download
memory/1988-3-0x0000000000390000-0x000000000039A000-memory.dmp

Filesize
40KB

Download
memory/1988-4-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/1988-5-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/1988-6-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download