aaa92cbd73a9fb7c74eaadb72a3a76d909d9f81d2dd6b096e9b6a31e1f1cc93a

Analysis

max time kernel
29s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 08:18

Target

aaa92cbd73a9fb7c74eaadb72a3a76d909d9f81d2dd6b096e9b6a31e1f1cc93a.exe
Size

54KB
MD5

6cb2d8767c1aaf2838b751e26fbd3c7a
SHA1

d550fca4af9cc77770ab6a4d870b75a4134d2304
SHA256

aaa92cbd73a9fb7c74eaadb72a3a76d909d9f81d2dd6b096e9b6a31e1f1cc93a
SHA512

ef909f510089275f28c049bdc23bcb218a4d1ad93351b80efd33700e17491e83472a380cc7e33cf7c90e992215f1b970b001895fa647b48042d8c32aaebe5a4a
SSDEEP

1536:7PTqOxxCtf9Oc1yeRct9fWbFby4cu7MNufs3f3:7LqObCtf84cWbFGuYNys3P

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1544	336	WerFault.exe	13

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 336 wrote to memory of 1544	336	aaa92cbd73a9fb7c74eaadb72a3a76d909d9f81d2dd6b096e9b6a31e1f1cc93a.exe	28
PID 336 wrote to memory of 1544	336	aaa92cbd73a9fb7c74eaadb72a3a76d909d9f81d2dd6b096e9b6a31e1f1cc93a.exe	28
PID 336 wrote to memory of 1544	336	aaa92cbd73a9fb7c74eaadb72a3a76d909d9f81d2dd6b096e9b6a31e1f1cc93a.exe	28
PID 336 wrote to memory of 1544	336	aaa92cbd73a9fb7c74eaadb72a3a76d909d9f81d2dd6b096e9b6a31e1f1cc93a.exe	28

C:\Users\Admin\AppData\Local\Temp\aaa92cbd73a9fb7c74eaadb72a3a76d909d9f81d2dd6b096e9b6a31e1f1cc93a.exe
"C:\Users\Admin\AppData\Local\Temp\aaa92cbd73a9fb7c74eaadb72a3a76d909d9f81d2dd6b096e9b6a31e1f1cc93a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 336 -s 36
  2⤵
  - Program crash
  PID:1544

memory/336-55-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download