a6435ee24a2fdf2bf0f2c6b05b67f5216aba382d5bc05c3ad539f73f7f7b66ef

Analysis

max time kernel
21s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 20:03

Target

a6435ee24a2fdf2bf0f2c6b05b67f5216aba382d5bc05c3ad539f73f7f7b66ef.exe
Size

48KB
MD5

d4d912c8c321699485b0c2df53c9457d
SHA1

bced871085afd168428286588e35cb5443fc3603
SHA256

a6435ee24a2fdf2bf0f2c6b05b67f5216aba382d5bc05c3ad539f73f7f7b66ef
SHA512

e3fde2f1cfa02e405b6f0eccc5602e96fc150249112bda3ecac0c279d0145b46d7dcd1ef4228dbf08797d9a53accbd4c459a41633da364b32dbb50cd47c4547b
SSDEEP

768:pT4tiTe8wUha/Bj32ikjcdPnGp6JffEtUUB55p:pTyh8wUhMrkjsecJ0tUU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
944	1368	WerFault.exe	13

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 944	1368	a6435ee24a2fdf2bf0f2c6b05b67f5216aba382d5bc05c3ad539f73f7f7b66ef.exe	28
PID 1368 wrote to memory of 944	1368	a6435ee24a2fdf2bf0f2c6b05b67f5216aba382d5bc05c3ad539f73f7f7b66ef.exe	28
PID 1368 wrote to memory of 944	1368	a6435ee24a2fdf2bf0f2c6b05b67f5216aba382d5bc05c3ad539f73f7f7b66ef.exe	28
PID 1368 wrote to memory of 944	1368	a6435ee24a2fdf2bf0f2c6b05b67f5216aba382d5bc05c3ad539f73f7f7b66ef.exe	28

C:\Users\Admin\AppData\Local\Temp\a6435ee24a2fdf2bf0f2c6b05b67f5216aba382d5bc05c3ad539f73f7f7b66ef.exe
"C:\Users\Admin\AppData\Local\Temp\a6435ee24a2fdf2bf0f2c6b05b67f5216aba382d5bc05c3ad539f73f7f7b66ef.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 36
  2⤵
  - Program crash
  PID:944