a7e1afb7afdda215cfe409d85a7ee7fcc82a039cf5e671278017442c997669fd

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 12:38

Target

a7e1afb7afdda215cfe409d85a7ee7fcc82a039cf5e671278017442c997669fd.exe
Size

48KB
MD5

5ce6a67d4b59189d701ae656d5cf1fbe
SHA1

ba4d1332c504b577b9d56e64f924f02ae9859caf
SHA256

a7e1afb7afdda215cfe409d85a7ee7fcc82a039cf5e671278017442c997669fd
SHA512

95e146d32e37d45ee09e9cf6c03a34a6697ee560f36eb7d45a29beeec0aa815f2eb39760c6ce2eb642a3309566100336580bc43f7643dc6cb54cba037dac2066
SSDEEP

768:UE/OA8FyKRuwjRGhedlrp0nnzlvaJXbgmj5MjSLCP0+pZkAyx6deV9x:DOSEjRFllz2mmj0CcI+q0x

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1824	1364	WerFault.exe	23

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 1824	1364	a7e1afb7afdda215cfe409d85a7ee7fcc82a039cf5e671278017442c997669fd.exe	28
PID 1364 wrote to memory of 1824	1364	a7e1afb7afdda215cfe409d85a7ee7fcc82a039cf5e671278017442c997669fd.exe	28
PID 1364 wrote to memory of 1824	1364	a7e1afb7afdda215cfe409d85a7ee7fcc82a039cf5e671278017442c997669fd.exe	28
PID 1364 wrote to memory of 1824	1364	a7e1afb7afdda215cfe409d85a7ee7fcc82a039cf5e671278017442c997669fd.exe	28

C:\Users\Admin\AppData\Local\Temp\a7e1afb7afdda215cfe409d85a7ee7fcc82a039cf5e671278017442c997669fd.exe
"C:\Users\Admin\AppData\Local\Temp\a7e1afb7afdda215cfe409d85a7ee7fcc82a039cf5e671278017442c997669fd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 120
  2⤵
  - Program crash
  PID:1824

memory/1364-54-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download
memory/1364-56-0x0000000000B30000-0x0000000000B4F000-memory.dmp

Filesize
124KB

Download