a35e23421e49d6c871aaedf866bb7f06615485649df532843219ec4f146ed18d

Analysis

max time kernel
32s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 04:10

Target

a35e23421e49d6c871aaedf866bb7f06615485649df532843219ec4f146ed18d.exe
Size

552KB
MD5

66ce6828a62916503259c3bdf1e4f075
SHA1

00d6fb46e7a3d5d5dfb22f50330863f119bb1305
SHA256

a35e23421e49d6c871aaedf866bb7f06615485649df532843219ec4f146ed18d
SHA512

e6bc8dffb6fab7e98f4210893e601c4fb9105ea381fe3a55eb47a22a75e4c62b9da452b1403ea53fd50f4ceb14cb8995e4d55ad84c73046f2d94bf056e0875e3
SSDEEP

6144:lhnLWO4EQ9cWD2mg2aLmRcoUY6deyZFcZUtNaw4xGY4BF5Tn9FmNLgve:lf4EQ9XSm1RVzSawwGYIIL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2032	1204	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 2032	1204	a35e23421e49d6c871aaedf866bb7f06615485649df532843219ec4f146ed18d.exe	27
PID 1204 wrote to memory of 2032	1204	a35e23421e49d6c871aaedf866bb7f06615485649df532843219ec4f146ed18d.exe	27
PID 1204 wrote to memory of 2032	1204	a35e23421e49d6c871aaedf866bb7f06615485649df532843219ec4f146ed18d.exe	27
PID 1204 wrote to memory of 2032	1204	a35e23421e49d6c871aaedf866bb7f06615485649df532843219ec4f146ed18d.exe	27

C:\Users\Admin\AppData\Local\Temp\a35e23421e49d6c871aaedf866bb7f06615485649df532843219ec4f146ed18d.exe
"C:\Users\Admin\AppData\Local\Temp\a35e23421e49d6c871aaedf866bb7f06615485649df532843219ec4f146ed18d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 188
  2⤵
  - Program crash
  PID:2032

memory/1204-54-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download