a3b8cc19c8ee6f1b6b17228366ce7fa186689048ccba4bdff14f445a74b0c51d

Analysis

max time kernel
235s
max time network
335s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 18:01

Target

a3b8cc19c8ee6f1b6b17228366ce7fa186689048ccba4bdff14f445a74b0c51d.exe
Size

92KB
MD5

594994c8fc6eda82a44d89fb389102fb
SHA1

5c423155b28d00a4d9ca61d239857cd40c4cc931
SHA256

a3b8cc19c8ee6f1b6b17228366ce7fa186689048ccba4bdff14f445a74b0c51d
SHA512

39a7c29e2a626f6e7a3262e77cfdc85f2a04a36ce1500ce1854cbebf48a725fe0e020ad7c2be979e8c82dad605a34e0c105ca937433cbec7d3688f8a7bd64c3b
SSDEEP

1536:kDGe2DKV7GcAJ4cRpa/Tb66JNULlSZ5h6T714g8RAdg8huqQNWOTUr3ABi:Be2DCGcY4cRpa/T+3LlU5MmgjFEVWOg3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
556	564	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 556	564	a3b8cc19c8ee6f1b6b17228366ce7fa186689048ccba4bdff14f445a74b0c51d.exe	28
PID 564 wrote to memory of 556	564	a3b8cc19c8ee6f1b6b17228366ce7fa186689048ccba4bdff14f445a74b0c51d.exe	28
PID 564 wrote to memory of 556	564	a3b8cc19c8ee6f1b6b17228366ce7fa186689048ccba4bdff14f445a74b0c51d.exe	28
PID 564 wrote to memory of 556	564	a3b8cc19c8ee6f1b6b17228366ce7fa186689048ccba4bdff14f445a74b0c51d.exe	28

C:\Users\Admin\AppData\Local\Temp\a3b8cc19c8ee6f1b6b17228366ce7fa186689048ccba4bdff14f445a74b0c51d.exe
"C:\Users\Admin\AppData\Local\Temp\a3b8cc19c8ee6f1b6b17228366ce7fa186689048ccba4bdff14f445a74b0c51d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 216
  2⤵
  - Program crash
  PID:556

memory/564-54-0x0000000000220000-0x000000000023B000-memory.dmp

Filesize
108KB

Download
memory/564-55-0x0000000000220000-0x000000000023B000-memory.dmp

Filesize
108KB

Download