866c0294731f195b0b9efa4f9b7cac352e8de5121f63a458a75efed3a625d24a

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 21:51

Target

easfawefawfas.exe
Size

12KB
MD5

2813b6e3ed4bd6b14c53e3dffcdff21d
SHA1

5ac7c7a3dadde70f94810c608a2eb275f14b7bde
SHA256

866c0294731f195b0b9efa4f9b7cac352e8de5121f63a458a75efed3a625d24a
SHA512

ff2454992a5fbe5c8cfab149ebd5edaa089ab4f25b88a47c5da0348575a72f1de372c8e762f74f284070a7a2e1209202ca755b4c08dd99799ac5bb9a598e0a24
SSDEEP

192:LsNqFnJvOXdub8t6QP+TXVKTl1hAKje2Ecp0Gun8JZcxZQF:LsNvuI6QIKTHhA8rt0nnicxo

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2064 2420 WerFault.exe easfawefawfas.exe

pid	pid_target	process	target process
2064	2420	WerFault.exe	easfawefawfas.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

easfawefawfas.exe

description	pid	process	target process
PID 2420 wrote to memory of 2064	2420	easfawefawfas.exe	WerFault.exe
PID 2420 wrote to memory of 2064	2420	easfawefawfas.exe	WerFault.exe
PID 2420 wrote to memory of 2064	2420	easfawefawfas.exe	WerFault.exe
PID 2420 wrote to memory of 2064	2420	easfawefawfas.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\easfawefawfas.exe
"C:\Users\Admin\AppData\Local\Temp\easfawefawfas.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 596
  2⤵
  - Program crash
  PID:2064

memory/2420-0-0x00000000742EE000-0x00000000742EF000-memory.dmp

Filesize
4KB

Download
memory/2420-1-0x00000000008A0000-0x00000000008AC000-memory.dmp

Filesize
48KB

Download
memory/2420-2-0x0000000000360000-0x000000000037A000-memory.dmp

Filesize
104KB

Download
memory/2420-3-0x00000000003D0000-0x00000000003DA000-memory.dmp

Filesize
40KB

Download
memory/2420-4-0x00000000742E0000-0x00000000749CE000-memory.dmp

Filesize
6.9MB

Download
memory/2420-5-0x00000000742EE000-0x00000000742EF000-memory.dmp

Filesize
4KB

Download
memory/2420-6-0x00000000742E0000-0x00000000749CE000-memory.dmp

Filesize
6.9MB

Download
memory/2420-7-0x00000000742E0000-0x00000000749CE000-memory.dmp

Filesize
6.9MB

Download