866c0294731f195b0b9efa4f9b7cac352e8de5121f63a458a75efed3a625d24a

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 21:51

Target

easfawefawfas.exe
Size

12KB
MD5

2813b6e3ed4bd6b14c53e3dffcdff21d
SHA1

5ac7c7a3dadde70f94810c608a2eb275f14b7bde
SHA256

866c0294731f195b0b9efa4f9b7cac352e8de5121f63a458a75efed3a625d24a
SHA512

ff2454992a5fbe5c8cfab149ebd5edaa089ab4f25b88a47c5da0348575a72f1de372c8e762f74f284070a7a2e1209202ca755b4c08dd99799ac5bb9a598e0a24
SSDEEP

192:LsNqFnJvOXdub8t6QP+TXVKTl1hAKje2Ecp0Gun8JZcxZQF:LsNvuI6QIKTHhA8rt0nnicxo

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3024 1368 WerFault.exe easfawefawfas.exe

pid	pid_target	process	target process
3024	1368	WerFault.exe	easfawefawfas.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

easfawefawfas.exe

description	pid	process	target process
PID 1368 wrote to memory of 3024	1368	easfawefawfas.exe	WerFault.exe
PID 1368 wrote to memory of 3024	1368	easfawefawfas.exe	WerFault.exe
PID 1368 wrote to memory of 3024	1368	easfawefawfas.exe	WerFault.exe
PID 1368 wrote to memory of 3024	1368	easfawefawfas.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\easfawefawfas.exe
"C:\Users\Admin\AppData\Local\Temp\easfawefawfas.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 592
2⤵
- Program crash
PID:3024

memory/1368-0-0x000000007476E000-0x000000007476F000-memory.dmp

Filesize
4KB

Download
memory/1368-1-0x0000000000E70000-0x0000000000E7C000-memory.dmp

Filesize
48KB

Download
memory/1368-2-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/1368-3-0x00000000002D0000-0x00000000002DA000-memory.dmp

Filesize
40KB

Download
memory/1368-4-0x0000000074760000-0x0000000074E4E000-memory.dmp

Filesize
6.9MB

Download
memory/1368-5-0x000000007476E000-0x000000007476F000-memory.dmp

Filesize
4KB

Download
memory/1368-6-0x0000000074760000-0x0000000074E4E000-memory.dmp

Filesize
6.9MB

Download
memory/1368-7-0x0000000074760000-0x0000000074E4E000-memory.dmp

Filesize
6.9MB

Download