a6e1d8a99cc661c270b7c7da6c4f9302ef394eb92848d4b42188f150284464f9

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 19:51

Target

a6e1d8a99cc661c270b7c7da6c4f9302ef394eb92848d4b42188f150284464f9.exe
Size

320KB
MD5

a10b0a7de5beabbcc753853392dd2270
SHA1

ed2d9b103273c811e212c84e834472e6fcb49439
SHA256

a6e1d8a99cc661c270b7c7da6c4f9302ef394eb92848d4b42188f150284464f9
SHA512

3b0a29b3c3236e75ff765b9078f79b61a83bb88009f2039ed042224a312cff517d798d2d1ecd431c41d8d22b20633532ef5952639cedf14af501b101bb9d6c32
SSDEEP

6144:PyyyyOQabTNCF7paH2RfS155ONNXBuWoJBO9OMbHLkAqF7Ief9UmM7/uT:dyu7a2EB0NxDIBuOFe7/uT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1744	1384	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 1744	1384	a6e1d8a99cc661c270b7c7da6c4f9302ef394eb92848d4b42188f150284464f9.exe	28
PID 1384 wrote to memory of 1744	1384	a6e1d8a99cc661c270b7c7da6c4f9302ef394eb92848d4b42188f150284464f9.exe	28
PID 1384 wrote to memory of 1744	1384	a6e1d8a99cc661c270b7c7da6c4f9302ef394eb92848d4b42188f150284464f9.exe	28
PID 1384 wrote to memory of 1744	1384	a6e1d8a99cc661c270b7c7da6c4f9302ef394eb92848d4b42188f150284464f9.exe	28

C:\Users\Admin\AppData\Local\Temp\a6e1d8a99cc661c270b7c7da6c4f9302ef394eb92848d4b42188f150284464f9.exe
"C:\Users\Admin\AppData\Local\Temp\a6e1d8a99cc661c270b7c7da6c4f9302ef394eb92848d4b42188f150284464f9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 36
  2⤵
  - Program crash
  PID:1744

memory/1384-54-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download