03af89ebc9fbe7e461203b44f6e78994f163d3d1bb55c1df8ead60ed6e74385c

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 18:52

Target

03af89ebc9fbe7e461203b44f6e78994f163d3d1bb55c1df8ead60ed6e74385c.exe
Size

67KB
MD5

9601a61ac87181e866d35dd3ccdbd32b
SHA1

13bb3f3f6c7eac79246d7dffeb35e0c46c45992b
SHA256

03af89ebc9fbe7e461203b44f6e78994f163d3d1bb55c1df8ead60ed6e74385c
SHA512

9e35e1951e9c551d19b08eb4dc2160678b43a8bc05caefb6a07156489ae501be4fc56083cc148acf69ee221e2600ed594f11333d581ec04a2cbf50e8a6b22f8b
SSDEEP

1536:iaLH/9RO3cFli5j0bzVHA8EroGsOZhNT5CBFH3etYu/MaQK:lH/zgAlSSZHAnsLy1Cb3e5hQK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1220	1716	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 1220	1716	03af89ebc9fbe7e461203b44f6e78994f163d3d1bb55c1df8ead60ed6e74385c.exe	27
PID 1716 wrote to memory of 1220	1716	03af89ebc9fbe7e461203b44f6e78994f163d3d1bb55c1df8ead60ed6e74385c.exe	27
PID 1716 wrote to memory of 1220	1716	03af89ebc9fbe7e461203b44f6e78994f163d3d1bb55c1df8ead60ed6e74385c.exe	27
PID 1716 wrote to memory of 1220	1716	03af89ebc9fbe7e461203b44f6e78994f163d3d1bb55c1df8ead60ed6e74385c.exe	27

C:\Users\Admin\AppData\Local\Temp\03af89ebc9fbe7e461203b44f6e78994f163d3d1bb55c1df8ead60ed6e74385c.exe
"C:\Users\Admin\AppData\Local\Temp\03af89ebc9fbe7e461203b44f6e78994f163d3d1bb55c1df8ead60ed6e74385c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 36
  2⤵
  - Program crash
  PID:1220

memory/1716-55-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download