a1bcfe3f06a7cb787fb7f4a0e7df9fa60d5409ce4c3d83fd49a5a439ff2c3563

Analysis

max time kernel
38s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 07:05

Target

a1bcfe3f06a7cb787fb7f4a0e7df9fa60d5409ce4c3d83fd49a5a439ff2c3563.exe
Size

44KB
MD5

7ceae40a3f854b964c47f916e30b85d0
SHA1

458e03cc47af494f585927ee58023bff72d5684f
SHA256

a1bcfe3f06a7cb787fb7f4a0e7df9fa60d5409ce4c3d83fd49a5a439ff2c3563
SHA512

8f6b250bf56c16b2bffe06c0fdf7b5e73a76a2f490b3308b6674275318b731bd15b721c54c7d70a971e2d83ecb09f0d5fd86e68848936c5f19bf82fcd1bc3947
SSDEEP

384:tgLpgelgyUtjs3cixpDf3ONekeuVF9Qa/dbDd92jGpzv8LKportSdk:AlBsjxiLfeA9uD9QIFrppzvbp6I2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1072	1652	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1072	1652	a1bcfe3f06a7cb787fb7f4a0e7df9fa60d5409ce4c3d83fd49a5a439ff2c3563.exe	27
PID 1652 wrote to memory of 1072	1652	a1bcfe3f06a7cb787fb7f4a0e7df9fa60d5409ce4c3d83fd49a5a439ff2c3563.exe	27
PID 1652 wrote to memory of 1072	1652	a1bcfe3f06a7cb787fb7f4a0e7df9fa60d5409ce4c3d83fd49a5a439ff2c3563.exe	27
PID 1652 wrote to memory of 1072	1652	a1bcfe3f06a7cb787fb7f4a0e7df9fa60d5409ce4c3d83fd49a5a439ff2c3563.exe	27

C:\Users\Admin\AppData\Local\Temp\a1bcfe3f06a7cb787fb7f4a0e7df9fa60d5409ce4c3d83fd49a5a439ff2c3563.exe
"C:\Users\Admin\AppData\Local\Temp\a1bcfe3f06a7cb787fb7f4a0e7df9fa60d5409ce4c3d83fd49a5a439ff2c3563.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 36
  2⤵
  - Program crash
  PID:1072