3a147d95310badb2aa255a963e7998397a58a07f1fe953139d0a1f7bcbb10d33

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 01:32

Target

3a147d95310badb2aa255a963e7998397a58a07f1fe953139d0a1f7bcbb10d33.exe
Size

56KB
MD5

1790a8c80ff02bca3ed1fd799060e700
SHA1

abd4f56be84149c3c4c0cec23917e9969b42912c
SHA256

3a147d95310badb2aa255a963e7998397a58a07f1fe953139d0a1f7bcbb10d33
SHA512

8541163e02cd3bc1992e2f849096a9469290f38cd187b9689db90715edf06046d441b980ce1659108e5d909cede45f46bca33940b2807075510c5bc4af9b2366
SSDEEP

768:OGGGGRY/xTpV9+xnjGuhtNmm68uDq6WVD1j9w22grwMdHTAfy0erMMtwJyDICZwv:Y+2Dc22grJH8L7MiJktAwemg9IoVZP9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1116	1128	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 1116	1128	3a147d95310badb2aa255a963e7998397a58a07f1fe953139d0a1f7bcbb10d33.exe	27
PID 1128 wrote to memory of 1116	1128	3a147d95310badb2aa255a963e7998397a58a07f1fe953139d0a1f7bcbb10d33.exe	27
PID 1128 wrote to memory of 1116	1128	3a147d95310badb2aa255a963e7998397a58a07f1fe953139d0a1f7bcbb10d33.exe	27
PID 1128 wrote to memory of 1116	1128	3a147d95310badb2aa255a963e7998397a58a07f1fe953139d0a1f7bcbb10d33.exe	27

C:\Users\Admin\AppData\Local\Temp\3a147d95310badb2aa255a963e7998397a58a07f1fe953139d0a1f7bcbb10d33.exe
"C:\Users\Admin\AppData\Local\Temp\3a147d95310badb2aa255a963e7998397a58a07f1fe953139d0a1f7bcbb10d33.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 36
  2⤵
  - Program crash
  PID:1116