ac64755a649c087492d362a7706344ae5d744f439905bbe4e2e08ee807a70904

Analysis

max time kernel
25s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 02:12

Target

ac64755a649c087492d362a7706344ae5d744f439905bbe4e2e08ee807a70904.exe
Size

20KB
MD5

456940ca7267036dbc0499afffc9adfc
SHA1

af05dba6fa5f634301359ceba4e688945a38fd27
SHA256

ac64755a649c087492d362a7706344ae5d744f439905bbe4e2e08ee807a70904
SHA512

741be45e3310cf3346461a38c009b53f3de6bb936ff11e9842dea39e49b491daca78b5a5d192f774d0bef9591683c5c63a209acd7512948d57dd593b44a0f289
SSDEEP

384:cWSe09fiod4is39tAgrtGWp22v3rAjuRH:Ti9fXd4xPprtGA22v38juJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1004	2032	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1004	2032	ac64755a649c087492d362a7706344ae5d744f439905bbe4e2e08ee807a70904.exe	28
PID 2032 wrote to memory of 1004	2032	ac64755a649c087492d362a7706344ae5d744f439905bbe4e2e08ee807a70904.exe	28
PID 2032 wrote to memory of 1004	2032	ac64755a649c087492d362a7706344ae5d744f439905bbe4e2e08ee807a70904.exe	28
PID 2032 wrote to memory of 1004	2032	ac64755a649c087492d362a7706344ae5d744f439905bbe4e2e08ee807a70904.exe	28

C:\Users\Admin\AppData\Local\Temp\ac64755a649c087492d362a7706344ae5d744f439905bbe4e2e08ee807a70904.exe
"C:\Users\Admin\AppData\Local\Temp\ac64755a649c087492d362a7706344ae5d744f439905bbe4e2e08ee807a70904.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 88
  2⤵
  - Program crash
  PID:1004

memory/2032-54-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download