3a3a7aa14de3422951c5deedfbbce702869da507b3550c7351bfd19c536ee27e

Analysis

max time kernel
29s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 23:25

Target

3a3a7aa14de3422951c5deedfbbce702869da507b3550c7351bfd19c536ee27e.exe
Size

206KB
MD5

684ebdd4fe451e0e63ef421ebd2ba4ad
SHA1

463504943c849c66cdbb8732ad627e849821872d
SHA256

3a3a7aa14de3422951c5deedfbbce702869da507b3550c7351bfd19c536ee27e
SHA512

a9f00fcaf078366f8948a065b6312e5ab6aa5311e4f40298c48f9a81655406f326f91110669784541e79c0535bc353b6053c49a6a3a96f5b94a98a10be8cf527
SSDEEP

1536:wD6vhT7lKlDau6flaLoRMtrXC2gyYy5cTTMIIM0YeaYuUs/25oiyEvUREK:wD2hT7lKb6fldRMtyyYyOTXsF5vyEvg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1368	1712	WerFault.exe	22

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1368	1712	3a3a7aa14de3422951c5deedfbbce702869da507b3550c7351bfd19c536ee27e.exe	27
PID 1712 wrote to memory of 1368	1712	3a3a7aa14de3422951c5deedfbbce702869da507b3550c7351bfd19c536ee27e.exe	27
PID 1712 wrote to memory of 1368	1712	3a3a7aa14de3422951c5deedfbbce702869da507b3550c7351bfd19c536ee27e.exe	27
PID 1712 wrote to memory of 1368	1712	3a3a7aa14de3422951c5deedfbbce702869da507b3550c7351bfd19c536ee27e.exe	27

C:\Users\Admin\AppData\Local\Temp\3a3a7aa14de3422951c5deedfbbce702869da507b3550c7351bfd19c536ee27e.exe
"C:\Users\Admin\AppData\Local\Temp\3a3a7aa14de3422951c5deedfbbce702869da507b3550c7351bfd19c536ee27e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 152
  2⤵
  - Program crash
  PID:1368

memory/1712-54-0x0000000075771000-0x0000000075773000-memory.dmp

Filesize
8KB

Download