af3b099144858f176b2b787252d4d3e783d3b2edc3064d4401bb395f969a3fff

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 22:24

Target

af3b099144858f176b2b787252d4d3e783d3b2edc3064d4401bb395f969a3fff.exe
Size

71KB
MD5

951548bed73f1230124d1de6daee173b
SHA1

78d364cda56467c796fec7ebbc0420c3b7fe1e8b
SHA256

af3b099144858f176b2b787252d4d3e783d3b2edc3064d4401bb395f969a3fff
SHA512

fb3ec584076eae4ca168945366f1471510cada0be1d5d8038dc2f121572f7b0b7aef2064e981932079494197f637be2f742a56cd96e5d604616b100670a1ea65
SSDEEP

1536:QzSGQbshcMNTjOq1VrSbm753aEL/AIwhOro1je7GMakWJ6:oSGdcMNTjDmb0aEL/XwhOrH7TAw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1080	2016	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1080	2016	af3b099144858f176b2b787252d4d3e783d3b2edc3064d4401bb395f969a3fff.exe	26
PID 2016 wrote to memory of 1080	2016	af3b099144858f176b2b787252d4d3e783d3b2edc3064d4401bb395f969a3fff.exe	26
PID 2016 wrote to memory of 1080	2016	af3b099144858f176b2b787252d4d3e783d3b2edc3064d4401bb395f969a3fff.exe	26
PID 2016 wrote to memory of 1080	2016	af3b099144858f176b2b787252d4d3e783d3b2edc3064d4401bb395f969a3fff.exe	26

C:\Users\Admin\AppData\Local\Temp\af3b099144858f176b2b787252d4d3e783d3b2edc3064d4401bb395f969a3fff.exe
"C:\Users\Admin\AppData\Local\Temp\af3b099144858f176b2b787252d4d3e783d3b2edc3064d4401bb395f969a3fff.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 36
  2⤵
  - Program crash
  PID:1080

memory/2016-55-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download