a64ce2eb37cd54b6db496ab16afb94538a781441351701550d60c03fa2934929

Analysis

max time kernel
38s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 09:39

Target

a64ce2eb37cd54b6db496ab16afb94538a781441351701550d60c03fa2934929.exe
Size

83KB
MD5

75d061d2dcc3162ad72ec6487a6c338f
SHA1

44ea7e9fa73f0194a3c22ad8d9af440edbb85b74
SHA256

a64ce2eb37cd54b6db496ab16afb94538a781441351701550d60c03fa2934929
SHA512

13fc3f58cf744fc5a7ec1d99049401d3f6ffc157dd418c0941c27c9b67057708f571d3a23742c323c9e02972d7513bdded372b5dcff6263de2f6d8293efeffad
SSDEEP

1536:61RxD1+NIgMZgHOCpLK0DCdMHKN/vO91Zbo6856kpjVrs2ryrd1vUQuqwcizSkX:SDUXpLKT5vo1+B56kHs2quciu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1988	544	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 544 wrote to memory of 1988	544	a64ce2eb37cd54b6db496ab16afb94538a781441351701550d60c03fa2934929.exe	26
PID 544 wrote to memory of 1988	544	a64ce2eb37cd54b6db496ab16afb94538a781441351701550d60c03fa2934929.exe	26
PID 544 wrote to memory of 1988	544	a64ce2eb37cd54b6db496ab16afb94538a781441351701550d60c03fa2934929.exe	26
PID 544 wrote to memory of 1988	544	a64ce2eb37cd54b6db496ab16afb94538a781441351701550d60c03fa2934929.exe	26

C:\Users\Admin\AppData\Local\Temp\a64ce2eb37cd54b6db496ab16afb94538a781441351701550d60c03fa2934929.exe
"C:\Users\Admin\AppData\Local\Temp\a64ce2eb37cd54b6db496ab16afb94538a781441351701550d60c03fa2934929.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 544 -s 36
  2⤵
  - Program crash
  PID:1988

memory/544-55-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download