a08549cddfff1367d5d1d3a0171bceacd36aaea05d9a5f3e8831dc9368eada57

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28-10-2022 02:52

Target

a08549cddfff1367d5d1d3a0171bceacd36aaea05d9a5f3e8831dc9368eada57.exe
Size

92KB
MD5

0defd95802a8871ac4dae9504cb7819d
SHA1

9f3f3182eb4db9177c28354e05a9b52d2624dacd
SHA256

a08549cddfff1367d5d1d3a0171bceacd36aaea05d9a5f3e8831dc9368eada57
SHA512

fcf316b8f73f5fba8b6510c8b491e4b24e4941568d5db11217fe3cc922adf30bc2eaa6c31a230281674f5740cade0d6cb4892a77dbfa038f9205f5f8e36afb83
SSDEEP

1536:NkoZt2qkwPObbCbhzhcXMVt6qg7Gvw3sqPYNXI+J:+8oMVt63G2QBJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1324	1404	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 1324	1404	a08549cddfff1367d5d1d3a0171bceacd36aaea05d9a5f3e8831dc9368eada57.exe	28
PID 1404 wrote to memory of 1324	1404	a08549cddfff1367d5d1d3a0171bceacd36aaea05d9a5f3e8831dc9368eada57.exe	28
PID 1404 wrote to memory of 1324	1404	a08549cddfff1367d5d1d3a0171bceacd36aaea05d9a5f3e8831dc9368eada57.exe	28
PID 1404 wrote to memory of 1324	1404	a08549cddfff1367d5d1d3a0171bceacd36aaea05d9a5f3e8831dc9368eada57.exe	28

C:\Users\Admin\AppData\Local\Temp\a08549cddfff1367d5d1d3a0171bceacd36aaea05d9a5f3e8831dc9368eada57.exe
"C:\Users\Admin\AppData\Local\Temp\a08549cddfff1367d5d1d3a0171bceacd36aaea05d9a5f3e8831dc9368eada57.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 96
  2⤵
  - Program crash
  PID:1324