aa8136be1546b1eb0cabd1f148e968603b69419ea9ac8713f358f629939478fb

Analysis

max time kernel
37s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 12:11

Target

aa8136be1546b1eb0cabd1f148e968603b69419ea9ac8713f358f629939478fb.exe
Size

591KB
MD5

a04607adee01cef08f1558a64eae7b20
SHA1

a985e57b5328988a1f7689c21442c46d1fc14c52
SHA256

aa8136be1546b1eb0cabd1f148e968603b69419ea9ac8713f358f629939478fb
SHA512

4a9c763223bff6ff6fecfad482fae6d131928c134b9cafb4c7d9f8d49130f912d585c7c9315ac0f1e18ed537f09d1595460c8b88a700ec31feec73599c8a939a
SSDEEP

12288:r+2S+BSMPoeOAiL2UhVlGnIqLqQGPb/4rWcwssC:iSBSMPoesL2UxGIqG/T/4kC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
908	880	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 908	880	aa8136be1546b1eb0cabd1f148e968603b69419ea9ac8713f358f629939478fb.exe	27
PID 880 wrote to memory of 908	880	aa8136be1546b1eb0cabd1f148e968603b69419ea9ac8713f358f629939478fb.exe	27
PID 880 wrote to memory of 908	880	aa8136be1546b1eb0cabd1f148e968603b69419ea9ac8713f358f629939478fb.exe	27
PID 880 wrote to memory of 908	880	aa8136be1546b1eb0cabd1f148e968603b69419ea9ac8713f358f629939478fb.exe	27

C:\Users\Admin\AppData\Local\Temp\aa8136be1546b1eb0cabd1f148e968603b69419ea9ac8713f358f629939478fb.exe
"C:\Users\Admin\AppData\Local\Temp\aa8136be1546b1eb0cabd1f148e968603b69419ea9ac8713f358f629939478fb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 880 -s 152
  2⤵
  - Program crash
  PID:908

memory/880-54-0x0000000076871000-0x0000000076873000-memory.dmp

Filesize
8KB

Download
memory/880-55-0x0000000000040000-0x000000000007F000-memory.dmp

Filesize
252KB

Download