a0d5c5c345ce0f5814ae61cb46ea07071e29a9d3cca060e76276111c9bb5acb4

Analysis

max time kernel
133s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 10:36

Target

a0d5c5c345ce0f5814ae61cb46ea07071e29a9d3cca060e76276111c9bb5acb4.exe
Size

84KB
MD5

2171fb572e052846c93e098b100ff560
SHA1

0d957d7cc186594b7d3aab9cc829aee9e7545a3f
SHA256

a0d5c5c345ce0f5814ae61cb46ea07071e29a9d3cca060e76276111c9bb5acb4
SHA512

91bade4a4923b65efa8fb3fde0390d493e91323a32e20f508c4415c72651316e1781862d39e1a61d6841374bc3897024177bc20529d77e296548522b1b0d5e1f
SSDEEP

1536:OfruUtdLzmucYPkRLTPP3Pso7RN64A6Y:KuUtLMFTnH7Rc4A6Y

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
612	1724	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 612	1724	a0d5c5c345ce0f5814ae61cb46ea07071e29a9d3cca060e76276111c9bb5acb4.exe	27
PID 1724 wrote to memory of 612	1724	a0d5c5c345ce0f5814ae61cb46ea07071e29a9d3cca060e76276111c9bb5acb4.exe	27
PID 1724 wrote to memory of 612	1724	a0d5c5c345ce0f5814ae61cb46ea07071e29a9d3cca060e76276111c9bb5acb4.exe	27
PID 1724 wrote to memory of 612	1724	a0d5c5c345ce0f5814ae61cb46ea07071e29a9d3cca060e76276111c9bb5acb4.exe	27

C:\Users\Admin\AppData\Local\Temp\a0d5c5c345ce0f5814ae61cb46ea07071e29a9d3cca060e76276111c9bb5acb4.exe
"C:\Users\Admin\AppData\Local\Temp\a0d5c5c345ce0f5814ae61cb46ea07071e29a9d3cca060e76276111c9bb5acb4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 92
  2⤵
  - Program crash
  PID:612

memory/1724-55-0x0000000001400000-0x0000000002400000-memory.dmp

Filesize
16.0MB

Download