7a1496feb7aa7791bae8c2f83ea451a8923dcef8569f0eaad6b2d8625af24752

Analysis

max time kernel
144s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 05:38

Target

7a1496feb7aa7791bae8c2f83ea451a8923dcef8569f0eaad6b2d8625af24752.exe
Size

564KB
MD5

6735af6c617d202f21a02d33b2f2aab0
SHA1

aa2d9c9a3e11d8c3e924513f962259f872d30af7
SHA256

7a1496feb7aa7791bae8c2f83ea451a8923dcef8569f0eaad6b2d8625af24752
SHA512

515780618e14daeea86e433d1e10682921b80790eabcd448b3441de4c9399cc4b943e1b928fab9cf25eb7b06bd3adbe877ad8cd140dd60ba047f3d73f01e7d7f
SSDEEP

12288:8laf6gbfo7vCQ8PE1wdHpCJ5LjnDPEAh5mIUXw6RhASsPd6:8MG7vC3PE1LjnrEAh5mtw5So8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
952	1996	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 952	1996	7a1496feb7aa7791bae8c2f83ea451a8923dcef8569f0eaad6b2d8625af24752.exe	27
PID 1996 wrote to memory of 952	1996	7a1496feb7aa7791bae8c2f83ea451a8923dcef8569f0eaad6b2d8625af24752.exe	27
PID 1996 wrote to memory of 952	1996	7a1496feb7aa7791bae8c2f83ea451a8923dcef8569f0eaad6b2d8625af24752.exe	27
PID 1996 wrote to memory of 952	1996	7a1496feb7aa7791bae8c2f83ea451a8923dcef8569f0eaad6b2d8625af24752.exe	27

C:\Users\Admin\AppData\Local\Temp\7a1496feb7aa7791bae8c2f83ea451a8923dcef8569f0eaad6b2d8625af24752.exe
"C:\Users\Admin\AppData\Local\Temp\7a1496feb7aa7791bae8c2f83ea451a8923dcef8569f0eaad6b2d8625af24752.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 200
  2⤵
  - Program crash
  PID:952

memory/1996-54-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1996-55-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download
memory/1996-57-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download