ae9cd1ae557a6cde271035f783ba30cb1c8d8cfbb4b0f6bb2c9286cc35f53c50

Analysis

max time kernel
44s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 20:16

Target

ae9cd1ae557a6cde271035f783ba30cb1c8d8cfbb4b0f6bb2c9286cc35f53c50.exe
Size

316KB
MD5

0c9bb0c34e15a52108d107acdf907189
SHA1

d432257a8abe24d8740d4c0140460fb3290c8cf7
SHA256

ae9cd1ae557a6cde271035f783ba30cb1c8d8cfbb4b0f6bb2c9286cc35f53c50
SHA512

4e6d888046f0489805b402dee4e04a48a11200934eaf41b8a40a338e2b5045c78d5a926186a24b04dda4dff8ca8012d09a0126fb40bd148268ffeaff3a6fbde8
SSDEEP

6144:tQV2hJrfB3+pM5aIOqLVJ5bbZXegqw48gyH0YtnbvK/kFZj:t22hJrp3/alWJtbZU8JFtrymB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1676	1092	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 1676	1092	ae9cd1ae557a6cde271035f783ba30cb1c8d8cfbb4b0f6bb2c9286cc35f53c50.exe	27
PID 1092 wrote to memory of 1676	1092	ae9cd1ae557a6cde271035f783ba30cb1c8d8cfbb4b0f6bb2c9286cc35f53c50.exe	27
PID 1092 wrote to memory of 1676	1092	ae9cd1ae557a6cde271035f783ba30cb1c8d8cfbb4b0f6bb2c9286cc35f53c50.exe	27
PID 1092 wrote to memory of 1676	1092	ae9cd1ae557a6cde271035f783ba30cb1c8d8cfbb4b0f6bb2c9286cc35f53c50.exe	27

C:\Users\Admin\AppData\Local\Temp\ae9cd1ae557a6cde271035f783ba30cb1c8d8cfbb4b0f6bb2c9286cc35f53c50.exe
"C:\Users\Admin\AppData\Local\Temp\ae9cd1ae557a6cde271035f783ba30cb1c8d8cfbb4b0f6bb2c9286cc35f53c50.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 132
  2⤵
  - Program crash
  PID:1676

memory/1092-55-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download