a1cc34da39e07c6bc62eef48cb162a7a702021c5077284bc94c6ea83ad2b7e83

Analysis

max time kernel
17s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 08:42

Target

a1cc34da39e07c6bc62eef48cb162a7a702021c5077284bc94c6ea83ad2b7e83.exe
Size

595KB
MD5

15b65d259baca6c64db329982ad54b8f
SHA1

19ae9d8abd78fb1d6b4b22f27c6979b21d9a637d
SHA256

a1cc34da39e07c6bc62eef48cb162a7a702021c5077284bc94c6ea83ad2b7e83
SHA512

75c0c9b8efd4955d6812764e44a4b831f4afc8053ad70174f91a9c99ead52c7fc7a7c580b9be177686f4a7e8576df1e3578b3124ca55ec6cbbfb1bb8ec88b33f
SSDEEP

12288:M+gdmaH0cB0rwdUtdSWqrSylLGWWaaMJ6KGPjzyUDQSsPdn:MfEgKwYodlWaaMJ6p7zXDQSo1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
836	1504	WerFault.exe	7

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 836	1504	a1cc34da39e07c6bc62eef48cb162a7a702021c5077284bc94c6ea83ad2b7e83.exe	28
PID 1504 wrote to memory of 836	1504	a1cc34da39e07c6bc62eef48cb162a7a702021c5077284bc94c6ea83ad2b7e83.exe	28
PID 1504 wrote to memory of 836	1504	a1cc34da39e07c6bc62eef48cb162a7a702021c5077284bc94c6ea83ad2b7e83.exe	28
PID 1504 wrote to memory of 836	1504	a1cc34da39e07c6bc62eef48cb162a7a702021c5077284bc94c6ea83ad2b7e83.exe	28

C:\Users\Admin\AppData\Local\Temp\a1cc34da39e07c6bc62eef48cb162a7a702021c5077284bc94c6ea83ad2b7e83.exe
"C:\Users\Admin\AppData\Local\Temp\a1cc34da39e07c6bc62eef48cb162a7a702021c5077284bc94c6ea83ad2b7e83.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 152
  2⤵
  - Program crash
  PID:836

memory/1504-54-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/1504-56-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download