ae196dbfeb872385d6aabdc7afcdff1fdaa3d36edfc1bfa8cafd37e56390a707

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 17:15

Target

ae196dbfeb872385d6aabdc7afcdff1fdaa3d36edfc1bfa8cafd37e56390a707.exe
Size

95KB
MD5

3e31647391d13ed9e0ea464fd8e3eff9
SHA1

949f8a99d714aa25821e2da7f0475bc8704698bb
SHA256

ae196dbfeb872385d6aabdc7afcdff1fdaa3d36edfc1bfa8cafd37e56390a707
SHA512

98a1d6bc9d52708bab51b2dc07c7550a35bd9995b607fa75acb2837b4b5c45afdede49fc436bdc18ac7d9c7e1c3941cec3f6769d4a500fb32789d3ff6418dc59
SSDEEP

1536:2iVKPw7B6u1J5C8eSni0kzDVlLrYnApbxMDc+Y2B29byKRnOh:JKPyF1ni06DVlLrYUmDj29uanOh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2004	1248	WerFault.exe	23

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 2004	1248	ae196dbfeb872385d6aabdc7afcdff1fdaa3d36edfc1bfa8cafd37e56390a707.exe	28
PID 1248 wrote to memory of 2004	1248	ae196dbfeb872385d6aabdc7afcdff1fdaa3d36edfc1bfa8cafd37e56390a707.exe	28
PID 1248 wrote to memory of 2004	1248	ae196dbfeb872385d6aabdc7afcdff1fdaa3d36edfc1bfa8cafd37e56390a707.exe	28
PID 1248 wrote to memory of 2004	1248	ae196dbfeb872385d6aabdc7afcdff1fdaa3d36edfc1bfa8cafd37e56390a707.exe	28

C:\Users\Admin\AppData\Local\Temp\ae196dbfeb872385d6aabdc7afcdff1fdaa3d36edfc1bfa8cafd37e56390a707.exe
"C:\Users\Admin\AppData\Local\Temp\ae196dbfeb872385d6aabdc7afcdff1fdaa3d36edfc1bfa8cafd37e56390a707.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 144
  2⤵
  - Program crash
  PID:2004