a5346bacdd80c94fba03c139313e094a0e0d15461b16f81fbb4d17f430134d2d

Analysis

max time kernel
13s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 07:35

Target

a5346bacdd80c94fba03c139313e094a0e0d15461b16f81fbb4d17f430134d2d.exe
Size

62KB
MD5

804d92a903a4db4816bf9bd03da99cb0
SHA1

342c1af3df79085a25243e955aa64b0423389427
SHA256

a5346bacdd80c94fba03c139313e094a0e0d15461b16f81fbb4d17f430134d2d
SHA512

2847bf40a049c7b93a6fa7bc2f4c1a35135c4acc99e5596f3effd55d592efce6602d80a2ca12ac740ba090f0cacc5f13d01d35747f7c233e6c8dadf35243bc39
SSDEEP

1536:KU177TQrmCO3MjBHsEATLyvybWtYEZg9JI:xfTQrv4gxEQybQFg9JI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1908	876	WerFault.exe	13

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 1908	876	a5346bacdd80c94fba03c139313e094a0e0d15461b16f81fbb4d17f430134d2d.exe	28
PID 876 wrote to memory of 1908	876	a5346bacdd80c94fba03c139313e094a0e0d15461b16f81fbb4d17f430134d2d.exe	28
PID 876 wrote to memory of 1908	876	a5346bacdd80c94fba03c139313e094a0e0d15461b16f81fbb4d17f430134d2d.exe	28
PID 876 wrote to memory of 1908	876	a5346bacdd80c94fba03c139313e094a0e0d15461b16f81fbb4d17f430134d2d.exe	28

C:\Users\Admin\AppData\Local\Temp\a5346bacdd80c94fba03c139313e094a0e0d15461b16f81fbb4d17f430134d2d.exe
"C:\Users\Admin\AppData\Local\Temp\a5346bacdd80c94fba03c139313e094a0e0d15461b16f81fbb4d17f430134d2d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 876 -s 36
  2⤵
  - Program crash
  PID:1908

memory/876-55-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download