a0ff4cec031f1481f8e5b9350eca67a1641dc71139252fc29419789f9c9f11cd

Analysis

max time kernel
8s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 01:17

Target

a0ff4cec031f1481f8e5b9350eca67a1641dc71139252fc29419789f9c9f11cd.exe
Size

233KB
MD5

39e6deb1e77fcfcf3fba8b8e789ad93e
SHA1

a03ffc26ed0b8579024b34b5c74a915e8403b8fe
SHA256

a0ff4cec031f1481f8e5b9350eca67a1641dc71139252fc29419789f9c9f11cd
SHA512

dbcce9f0978fd0b4c4392fcd6e7b025b6c2987718a2639bc62a2874fd40a6904a2ffd5a7322e09dd3680726e48b8e9a5e6ceea04f6cf18ecac2faf9a9fbec6b5
SSDEEP

6144:M+C2F8NXC796TB9vj48UapjhOJCOPayFx9s1/:MIeVQkTrvj44jhICS5s1/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1508	876	WerFault.exe	13

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 1508	876	a0ff4cec031f1481f8e5b9350eca67a1641dc71139252fc29419789f9c9f11cd.exe	29
PID 876 wrote to memory of 1508	876	a0ff4cec031f1481f8e5b9350eca67a1641dc71139252fc29419789f9c9f11cd.exe	29
PID 876 wrote to memory of 1508	876	a0ff4cec031f1481f8e5b9350eca67a1641dc71139252fc29419789f9c9f11cd.exe	29
PID 876 wrote to memory of 1508	876	a0ff4cec031f1481f8e5b9350eca67a1641dc71139252fc29419789f9c9f11cd.exe	29

C:\Users\Admin\AppData\Local\Temp\a0ff4cec031f1481f8e5b9350eca67a1641dc71139252fc29419789f9c9f11cd.exe
"C:\Users\Admin\AppData\Local\Temp\a0ff4cec031f1481f8e5b9350eca67a1641dc71139252fc29419789f9c9f11cd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 876 -s 464
  2⤵
  - Program crash
  PID:1508

memory/876-54-0x0000000000440000-0x000000000047C000-memory.dmp

Filesize
240KB

Download