a39a819327ab88b7bd96fb4de2ddd53e572aa1eada573bc3e1b237459d6f3653

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 01:17

Target

a39a819327ab88b7bd96fb4de2ddd53e572aa1eada573bc3e1b237459d6f3653.exe
Size

68KB
MD5

6a2e605308f45217f9a6fd638e4e702c
SHA1

0fe7919de327d374182740b5c4e2a0b69f6175e7
SHA256

a39a819327ab88b7bd96fb4de2ddd53e572aa1eada573bc3e1b237459d6f3653
SHA512

56314e065d82f082910a066dd0d52aa0b9a8270b1696b85f4f9e7f11929c15ebf0e874420c3dc002b28d435bf3826984b0fcbee417b33095b3301e4b81e2efb1
SSDEEP

1536:lZ1BpMFU8DjW4fKLy5fqz6UyMdKBfD7sCk71S5TNZ8xJmfG9if:H1BpSU8bT5CzJJkr7tYSJveg6if

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
980	2024	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 980	2024	a39a819327ab88b7bd96fb4de2ddd53e572aa1eada573bc3e1b237459d6f3653.exe	27
PID 2024 wrote to memory of 980	2024	a39a819327ab88b7bd96fb4de2ddd53e572aa1eada573bc3e1b237459d6f3653.exe	27
PID 2024 wrote to memory of 980	2024	a39a819327ab88b7bd96fb4de2ddd53e572aa1eada573bc3e1b237459d6f3653.exe	27
PID 2024 wrote to memory of 980	2024	a39a819327ab88b7bd96fb4de2ddd53e572aa1eada573bc3e1b237459d6f3653.exe	27

C:\Users\Admin\AppData\Local\Temp\a39a819327ab88b7bd96fb4de2ddd53e572aa1eada573bc3e1b237459d6f3653.exe
"C:\Users\Admin\AppData\Local\Temp\a39a819327ab88b7bd96fb4de2ddd53e572aa1eada573bc3e1b237459d6f3653.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 36
  2⤵
  - Program crash
  PID:980

memory/2024-55-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download