a1d7bef3584e988c9130d37e4d229e9e403d31f09d48be41a69555627028b58f

Analysis

max time kernel
23s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 08:05

Target

a1d7bef3584e988c9130d37e4d229e9e403d31f09d48be41a69555627028b58f.exe
Size

28KB
MD5

1a4fdbac7c040cb8041e737d93d7b276
SHA1

2f862ea615594e087f791af8079998f61896bb90
SHA256

a1d7bef3584e988c9130d37e4d229e9e403d31f09d48be41a69555627028b58f
SHA512

9566ee0250f8f521c44872be0cef0abb44630124a9f9d82fc4d9c58b3fbef582671cdd725c50132d597f9f86aa19b1321ed953e2da8efcc1e1016c12119f3e5f
SSDEEP

768:+4pX7bvK7FchM2Jn3sCPciEYEzx2fv5tq:+4lynFOciuxYBtq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
996	1904	WerFault.exe	10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 996	1904	a1d7bef3584e988c9130d37e4d229e9e403d31f09d48be41a69555627028b58f.exe	27
PID 1904 wrote to memory of 996	1904	a1d7bef3584e988c9130d37e4d229e9e403d31f09d48be41a69555627028b58f.exe	27
PID 1904 wrote to memory of 996	1904	a1d7bef3584e988c9130d37e4d229e9e403d31f09d48be41a69555627028b58f.exe	27
PID 1904 wrote to memory of 996	1904	a1d7bef3584e988c9130d37e4d229e9e403d31f09d48be41a69555627028b58f.exe	27

C:\Users\Admin\AppData\Local\Temp\a1d7bef3584e988c9130d37e4d229e9e403d31f09d48be41a69555627028b58f.exe
"C:\Users\Admin\AppData\Local\Temp\a1d7bef3584e988c9130d37e4d229e9e403d31f09d48be41a69555627028b58f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 88
  2⤵
  - Program crash
  PID:996

memory/1904-55-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download