a1a3dea7fb2e07f7250e94284d8cd9f975b4f45fc03e9a25ed3254697d7bbfc4

Analysis

max time kernel
46s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 05:40

Target

a1a3dea7fb2e07f7250e94284d8cd9f975b4f45fc03e9a25ed3254697d7bbfc4.exe
Size

155KB
MD5

254c0b87eccbdd9d906eea00651646de
SHA1

8da53ff39217637c5883f517fb570fa3fa10e306
SHA256

a1a3dea7fb2e07f7250e94284d8cd9f975b4f45fc03e9a25ed3254697d7bbfc4
SHA512

6911173d02615b9c6bf0ec5b37747d90620acca21162881ab433bdd12ea14d3aec985ff550388aca99b188384a44176c0e2303d31e9b7c4e75b848d819c2ae75
SSDEEP

3072:l5K/B0toLQSNJslZHQsozTS+SMqqDL2/TrKYoG:lcytwtQ1yTS+xqqDL6HKm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1948	1444	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 1948	1444	a1a3dea7fb2e07f7250e94284d8cd9f975b4f45fc03e9a25ed3254697d7bbfc4.exe	27
PID 1444 wrote to memory of 1948	1444	a1a3dea7fb2e07f7250e94284d8cd9f975b4f45fc03e9a25ed3254697d7bbfc4.exe	27
PID 1444 wrote to memory of 1948	1444	a1a3dea7fb2e07f7250e94284d8cd9f975b4f45fc03e9a25ed3254697d7bbfc4.exe	27
PID 1444 wrote to memory of 1948	1444	a1a3dea7fb2e07f7250e94284d8cd9f975b4f45fc03e9a25ed3254697d7bbfc4.exe	27

C:\Users\Admin\AppData\Local\Temp\a1a3dea7fb2e07f7250e94284d8cd9f975b4f45fc03e9a25ed3254697d7bbfc4.exe
"C:\Users\Admin\AppData\Local\Temp\a1a3dea7fb2e07f7250e94284d8cd9f975b4f45fc03e9a25ed3254697d7bbfc4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 88
  2⤵
  - Program crash
  PID:1948