a2ab45b41fb38ac609ec989bf3c4b17e2bfcf05a2805a26647fab5ad49c34a82

Analysis

max time kernel
33s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 19:45

Target

a2ab45b41fb38ac609ec989bf3c4b17e2bfcf05a2805a26647fab5ad49c34a82.exe
Size

12KB
MD5

a34d14641cfbea54e20e5ac1a56151ff
SHA1

6cf2c0bf3501da89cf5b66b52bf352715a06d61c
SHA256

a2ab45b41fb38ac609ec989bf3c4b17e2bfcf05a2805a26647fab5ad49c34a82
SHA512

2d9b53505917b3dde01a83c69c7c74dac00f06212e26329d7b368cf2fde6f16d48468692b9cfdd32113c5a2ce70c9c81b3b6c6524e71973b9d16b34fd4e55fa8
SSDEEP

48:6VXmcE/+NoERq2ZvWM7nI3eF73F3uNeL22Iaql0DGzGEcaftJow7EK6ZYevQtQKo:cHKEM2Zu2JuBnlGKB71yQtQKQYQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1492	1940	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 1492	1940	a2ab45b41fb38ac609ec989bf3c4b17e2bfcf05a2805a26647fab5ad49c34a82.exe	27
PID 1940 wrote to memory of 1492	1940	a2ab45b41fb38ac609ec989bf3c4b17e2bfcf05a2805a26647fab5ad49c34a82.exe	27
PID 1940 wrote to memory of 1492	1940	a2ab45b41fb38ac609ec989bf3c4b17e2bfcf05a2805a26647fab5ad49c34a82.exe	27
PID 1940 wrote to memory of 1492	1940	a2ab45b41fb38ac609ec989bf3c4b17e2bfcf05a2805a26647fab5ad49c34a82.exe	27

C:\Users\Admin\AppData\Local\Temp\a2ab45b41fb38ac609ec989bf3c4b17e2bfcf05a2805a26647fab5ad49c34a82.exe
"C:\Users\Admin\AppData\Local\Temp\a2ab45b41fb38ac609ec989bf3c4b17e2bfcf05a2805a26647fab5ad49c34a82.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 88
  2⤵
  - Program crash
  PID:1492