2aea916136c2eaf9a3386bf9c408a28b840a0fc62ee0bbcf502d439ba35c37db

Analysis

max time kernel
41s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 21:04

Target

2aea916136c2eaf9a3386bf9c408a28b840a0fc62ee0bbcf502d439ba35c37db.exe
Size

1.0MB
MD5

f42d0e320cfe0f7399ac63cb3e12b587
SHA1

d50034e5ac03d49b425b8966dbdbb432b37d851c
SHA256

2aea916136c2eaf9a3386bf9c408a28b840a0fc62ee0bbcf502d439ba35c37db
SHA512

fb03f9419632cf629681d10c809cfcc8a03639b8aa6f6e5d8beea6b929dfa1657d877be491b9eae733887361cd0a24727ea1e38117c734bde5aa91f2100e0abd
SSDEEP

24576:ss1u1q6qYboSnMoTdylU+MpR2xAKvQzxvAZb3cFb:ss1u1q6q0DTdylYR2fvqxvAZcb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
280	960	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 280	960	2aea916136c2eaf9a3386bf9c408a28b840a0fc62ee0bbcf502d439ba35c37db.exe	28
PID 960 wrote to memory of 280	960	2aea916136c2eaf9a3386bf9c408a28b840a0fc62ee0bbcf502d439ba35c37db.exe	28
PID 960 wrote to memory of 280	960	2aea916136c2eaf9a3386bf9c408a28b840a0fc62ee0bbcf502d439ba35c37db.exe	28
PID 960 wrote to memory of 280	960	2aea916136c2eaf9a3386bf9c408a28b840a0fc62ee0bbcf502d439ba35c37db.exe	28

C:\Users\Admin\AppData\Local\Temp\2aea916136c2eaf9a3386bf9c408a28b840a0fc62ee0bbcf502d439ba35c37db.exe
"C:\Users\Admin\AppData\Local\Temp\2aea916136c2eaf9a3386bf9c408a28b840a0fc62ee0bbcf502d439ba35c37db.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 200
  2⤵
  - Program crash
  PID:280

memory/960-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download