a72aefd476ea4664bb7912f4507439aea9ec4ed56f597a163135b72cde47359a

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 12:48

Target

a72aefd476ea4664bb7912f4507439aea9ec4ed56f597a163135b72cde47359a.exe
Size

148KB
MD5

2f6bbe405a492ebc36f6ab64be80b6b6
SHA1

abe6ca088ce0612a2ce258a272d32684b261e5d6
SHA256

a72aefd476ea4664bb7912f4507439aea9ec4ed56f597a163135b72cde47359a
SHA512

e62d7094484786b6988b79134a8e24c42af8f850326956dfd041ab1a084b52215d48da45dd3a4122973faa01d752de83ddd2490178d68fca78d95222b77519fd
SSDEEP

3072:ZDPShB5nqHcGfi8NZL7stJf6aL/9JyuqDS2ewOc4lZ2QZ:ZDanqHHi8PcUsqfxulZ2Q

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
544	1424	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 544	1424	a72aefd476ea4664bb7912f4507439aea9ec4ed56f597a163135b72cde47359a.exe	26
PID 1424 wrote to memory of 544	1424	a72aefd476ea4664bb7912f4507439aea9ec4ed56f597a163135b72cde47359a.exe	26
PID 1424 wrote to memory of 544	1424	a72aefd476ea4664bb7912f4507439aea9ec4ed56f597a163135b72cde47359a.exe	26
PID 1424 wrote to memory of 544	1424	a72aefd476ea4664bb7912f4507439aea9ec4ed56f597a163135b72cde47359a.exe	26

C:\Users\Admin\AppData\Local\Temp\a72aefd476ea4664bb7912f4507439aea9ec4ed56f597a163135b72cde47359a.exe
"C:\Users\Admin\AppData\Local\Temp\a72aefd476ea4664bb7912f4507439aea9ec4ed56f597a163135b72cde47359a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 116
  2⤵
  - Program crash
  PID:544

memory/1424-54-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download
memory/1424-56-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download