a7c0deea536e09712d9a155132b0df0b9caa2d867b8776569a5c1dc16f3ebdea

Analysis

max time kernel
46s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 16:42

Target

a7c0deea536e09712d9a155132b0df0b9caa2d867b8776569a5c1dc16f3ebdea.exe
Size

80KB
MD5

06b3006ddeca5e4c7adff0401cd5cc34
SHA1

a97e448ec11cd5e0f7ff39e1765f1813487d3ce3
SHA256

a7c0deea536e09712d9a155132b0df0b9caa2d867b8776569a5c1dc16f3ebdea
SHA512

fb7b80099526929bc2d98d93e14080f65cee9568546baa62bdbc1efaf253dfe90983f79e7cf0077e6aa3e90d621730ee455bf996c8ebae49c213335c1249980b
SSDEEP

1536:W32D306WeCUlnRjIudrE53bxL8RfjYzbZg5uqV3oesc6sKuWku0eJr:W3YE69JIao5rxC7DKusL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1612	1544	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 1612	1544	a7c0deea536e09712d9a155132b0df0b9caa2d867b8776569a5c1dc16f3ebdea.exe	26
PID 1544 wrote to memory of 1612	1544	a7c0deea536e09712d9a155132b0df0b9caa2d867b8776569a5c1dc16f3ebdea.exe	26
PID 1544 wrote to memory of 1612	1544	a7c0deea536e09712d9a155132b0df0b9caa2d867b8776569a5c1dc16f3ebdea.exe	26
PID 1544 wrote to memory of 1612	1544	a7c0deea536e09712d9a155132b0df0b9caa2d867b8776569a5c1dc16f3ebdea.exe	26

C:\Users\Admin\AppData\Local\Temp\a7c0deea536e09712d9a155132b0df0b9caa2d867b8776569a5c1dc16f3ebdea.exe
"C:\Users\Admin\AppData\Local\Temp\a7c0deea536e09712d9a155132b0df0b9caa2d867b8776569a5c1dc16f3ebdea.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 200
  2⤵
  - Program crash
  PID:1612

memory/1544-54-0x0000000075681000-0x0000000075683000-memory.dmp

Filesize
8KB

Download
memory/1544-56-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download