aceac77e9034bfd44ae9a4d069f6b6a0b7190c9d4b844bdc64f72e7adb2f4a6a

Analysis

max time kernel
37s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 04:04

Target

aceac77e9034bfd44ae9a4d069f6b6a0b7190c9d4b844bdc64f72e7adb2f4a6a.exe
Size

128KB
MD5

652d0c07cdc5539c7b4da5ff20ba4f60
SHA1

bdcc528d3433b8b5d8d4e3a63623dc988c88b79d
SHA256

aceac77e9034bfd44ae9a4d069f6b6a0b7190c9d4b844bdc64f72e7adb2f4a6a
SHA512

04fb057c88b1485e90f69bb78a9c25f9d4d35f0dcdfa011a4e6b4815c85f24681c00e76947c811215926aee7432dd9021ad4c6d6ec4b4caab1f64084c9a19ffc
SSDEEP

1536:p7QQYlq9tqe68YSCQ8WyYT0qqZCJ0UjWLGhsL5TWtyaAITLVfK:VQZlq9t368ozZRUyCKLAsa9K

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1536	536	WerFault.exe	7

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 1536	536	aceac77e9034bfd44ae9a4d069f6b6a0b7190c9d4b844bdc64f72e7adb2f4a6a.exe	28
PID 536 wrote to memory of 1536	536	aceac77e9034bfd44ae9a4d069f6b6a0b7190c9d4b844bdc64f72e7adb2f4a6a.exe	28
PID 536 wrote to memory of 1536	536	aceac77e9034bfd44ae9a4d069f6b6a0b7190c9d4b844bdc64f72e7adb2f4a6a.exe	28
PID 536 wrote to memory of 1536	536	aceac77e9034bfd44ae9a4d069f6b6a0b7190c9d4b844bdc64f72e7adb2f4a6a.exe	28

C:\Users\Admin\AppData\Local\Temp\aceac77e9034bfd44ae9a4d069f6b6a0b7190c9d4b844bdc64f72e7adb2f4a6a.exe
"C:\Users\Admin\AppData\Local\Temp\aceac77e9034bfd44ae9a4d069f6b6a0b7190c9d4b844bdc64f72e7adb2f4a6a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 72
  2⤵
  - Program crash
  PID:1536

memory/536-55-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download