05ae162dd78e97503561dc1676aad30647c2f1f2f4e2c47d8f0125bbdc3ae9fc

Analysis

max time kernel
16s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 09:49

Target

05ae162dd78e97503561dc1676aad30647c2f1f2f4e2c47d8f0125bbdc3ae9fc.exe
Size

71KB
MD5

3e3fafc39f783b6d6a7dee0e90b6ca42
SHA1

461dffe9d99d0afc02b5d4534b7e151a82946001
SHA256

05ae162dd78e97503561dc1676aad30647c2f1f2f4e2c47d8f0125bbdc3ae9fc
SHA512

53f13908fd493ed3db01079900aece2f5361d5382909d552f484615821ecbaf9e6b5ea85705298002df226c4b0f6ebd981b71198d3c389491a63cb06f470d2bb
SSDEEP

768:TE/OA8FyKRuwjRGhedlrp0nnzlvaJXbgmj5MjSLCP0+pZkAyx6deV9:yOSEjRFllz2mmj0CcI+q0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1284	1952	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 1284	1952	05ae162dd78e97503561dc1676aad30647c2f1f2f4e2c47d8f0125bbdc3ae9fc.exe	28
PID 1952 wrote to memory of 1284	1952	05ae162dd78e97503561dc1676aad30647c2f1f2f4e2c47d8f0125bbdc3ae9fc.exe	28
PID 1952 wrote to memory of 1284	1952	05ae162dd78e97503561dc1676aad30647c2f1f2f4e2c47d8f0125bbdc3ae9fc.exe	28
PID 1952 wrote to memory of 1284	1952	05ae162dd78e97503561dc1676aad30647c2f1f2f4e2c47d8f0125bbdc3ae9fc.exe	28

C:\Users\Admin\AppData\Local\Temp\05ae162dd78e97503561dc1676aad30647c2f1f2f4e2c47d8f0125bbdc3ae9fc.exe
"C:\Users\Admin\AppData\Local\Temp\05ae162dd78e97503561dc1676aad30647c2f1f2f4e2c47d8f0125bbdc3ae9fc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 120
  2⤵
  - Program crash
  PID:1284

memory/1952-54-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download
memory/1952-56-0x0000000000F10000-0x0000000000F2F000-memory.dmp

Filesize
124KB

Download