3a7e5f23c33c1c92b91317904c609bbaceb56db6f5310b86c060d094f1b3a11a

Analysis

max time kernel
224s
max time network
332s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 05:02

Target

3a7e5f23c33c1c92b91317904c609bbaceb56db6f5310b86c060d094f1b3a11a.exe
Size

54KB
MD5

c870ca72132c44823de8c556cec036d3
SHA1

80ed2eccd9adc29a4b3899fea806d038e78134c1
SHA256

3a7e5f23c33c1c92b91317904c609bbaceb56db6f5310b86c060d094f1b3a11a
SHA512

908acd69f05b016ae434dca4e5477104982864908f5dd23e16c391ff8b94bc208214cc3f6d69ed60e25a41f9d39e9f26c5abe304b59f17cca349175fd03eb57b
SSDEEP

768:CJ1fqe9vLBiQzuNxADa/t7/qVKzrf/MqDEzwBpwg6myS39zzLibs8YfXEEJW+3:2SetBF8aKt7/rzrfEqDG7q9PubDY9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1344	1172	WerFault.exe	12

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 1344	1172	3a7e5f23c33c1c92b91317904c609bbaceb56db6f5310b86c060d094f1b3a11a.exe	28
PID 1172 wrote to memory of 1344	1172	3a7e5f23c33c1c92b91317904c609bbaceb56db6f5310b86c060d094f1b3a11a.exe	28
PID 1172 wrote to memory of 1344	1172	3a7e5f23c33c1c92b91317904c609bbaceb56db6f5310b86c060d094f1b3a11a.exe	28
PID 1172 wrote to memory of 1344	1172	3a7e5f23c33c1c92b91317904c609bbaceb56db6f5310b86c060d094f1b3a11a.exe	28

C:\Users\Admin\AppData\Local\Temp\3a7e5f23c33c1c92b91317904c609bbaceb56db6f5310b86c060d094f1b3a11a.exe
"C:\Users\Admin\AppData\Local\Temp\3a7e5f23c33c1c92b91317904c609bbaceb56db6f5310b86c060d094f1b3a11a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1172 -s 164
  2⤵
  - Program crash
  PID:1344

memory/1172-54-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download