abb37cb903c64140c48dd3ae9e81d4b33981b81aa909d411b5e740839a2aba3a

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 14:12

Target

abb37cb903c64140c48dd3ae9e81d4b33981b81aa909d411b5e740839a2aba3a.exe
Size

56KB
MD5

055f73c6f4bcc7fc21882bed95bb2e88
SHA1

f907902824e0e0f301c8ef59d2116cda50476818
SHA256

abb37cb903c64140c48dd3ae9e81d4b33981b81aa909d411b5e740839a2aba3a
SHA512

6998c1f283c5a7f535c20e7480aa1e0b76f83e9b4f8160778350fd9313e410a8bed709918452a5030857464a2314e8323bb300017cacaa5816f310ffeca9d44a
SSDEEP

1536:0AgJwQ+9ZPsoXukR3QxiUPnAtLW7NwRLbCgnyE+p4cA:0AgJmPZX5RCnGWJ4LbVyE+p/A

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1832	1960	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1832	1960	abb37cb903c64140c48dd3ae9e81d4b33981b81aa909d411b5e740839a2aba3a.exe	28
PID 1960 wrote to memory of 1832	1960	abb37cb903c64140c48dd3ae9e81d4b33981b81aa909d411b5e740839a2aba3a.exe	28
PID 1960 wrote to memory of 1832	1960	abb37cb903c64140c48dd3ae9e81d4b33981b81aa909d411b5e740839a2aba3a.exe	28
PID 1960 wrote to memory of 1832	1960	abb37cb903c64140c48dd3ae9e81d4b33981b81aa909d411b5e740839a2aba3a.exe	28

C:\Users\Admin\AppData\Local\Temp\abb37cb903c64140c48dd3ae9e81d4b33981b81aa909d411b5e740839a2aba3a.exe
"C:\Users\Admin\AppData\Local\Temp\abb37cb903c64140c48dd3ae9e81d4b33981b81aa909d411b5e740839a2aba3a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 36
  2⤵
  - Program crash
  PID:1832