a556fc9a00da9174be1d6357cfd91baffafb01bb12442d4aaf93692b503250c4

Analysis

max time kernel
34s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-10-2022 22:13

Target

a556fc9a00da9174be1d6357cfd91baffafb01bb12442d4aaf93692b503250c4.exe
Size

168KB
MD5

a19358a179382f16e196f6192487a0e0
SHA1

b0fe1912aeeb6200a65d83d3381722a37960e887
SHA256

a556fc9a00da9174be1d6357cfd91baffafb01bb12442d4aaf93692b503250c4
SHA512

438c5fd6c5ccb86997d164f3d5c531973f539fe099fc1f7bd654383099864945ab5a22bb7e8a977c822d9a73ecdb2ceec8f1331eb204f455a485f758a3b1e9e3
SSDEEP

3072:yqPL1/7w6ZAs+VBK3NMm3E4bdGPqdojAZSRJFhr9hoO:3QVuuzPqGjfRpo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1860	1704	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1860	1704	a556fc9a00da9174be1d6357cfd91baffafb01bb12442d4aaf93692b503250c4.exe	26
PID 1704 wrote to memory of 1860	1704	a556fc9a00da9174be1d6357cfd91baffafb01bb12442d4aaf93692b503250c4.exe	26
PID 1704 wrote to memory of 1860	1704	a556fc9a00da9174be1d6357cfd91baffafb01bb12442d4aaf93692b503250c4.exe	26
PID 1704 wrote to memory of 1860	1704	a556fc9a00da9174be1d6357cfd91baffafb01bb12442d4aaf93692b503250c4.exe	26

C:\Users\Admin\AppData\Local\Temp\a556fc9a00da9174be1d6357cfd91baffafb01bb12442d4aaf93692b503250c4.exe
"C:\Users\Admin\AppData\Local\Temp\a556fc9a00da9174be1d6357cfd91baffafb01bb12442d4aaf93692b503250c4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 132
  2⤵
  - Program crash
  PID:1860

memory/1704-54-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1860-55-0x0000000000000000-mapping.dmp

Download