a1f155af8c27e665f9bf21d8ccad1114f774c71edb1713b70a8e0bbd79f5630d

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 08:49

Target

a1f155af8c27e665f9bf21d8ccad1114f774c71edb1713b70a8e0bbd79f5630d.exe
Size

62KB
MD5

979494795eed4df9df7c74eeb4adbf03
SHA1

a09b107f9a2d272733000da984102fade9c8911b
SHA256

a1f155af8c27e665f9bf21d8ccad1114f774c71edb1713b70a8e0bbd79f5630d
SHA512

443ecf7942ea462b11e6324de7298466845bf883b9c4cbc89e4e37e5476286b87b8bd7ffbdea7adfdccebb4b48d816520c17934185d4e816b99abc8905a9d832
SSDEEP

768:qdufniOczsLQl3tzD3Wb6ahUigjS24cZ9hUOvM+V/pW65CCWgJ10JDyMIDm/dXDd:qTssTDlVciVc6faQ+mYRewl3fe3sBip

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
840	1000	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 840	1000	a1f155af8c27e665f9bf21d8ccad1114f774c71edb1713b70a8e0bbd79f5630d.exe	27
PID 1000 wrote to memory of 840	1000	a1f155af8c27e665f9bf21d8ccad1114f774c71edb1713b70a8e0bbd79f5630d.exe	27
PID 1000 wrote to memory of 840	1000	a1f155af8c27e665f9bf21d8ccad1114f774c71edb1713b70a8e0bbd79f5630d.exe	27
PID 1000 wrote to memory of 840	1000	a1f155af8c27e665f9bf21d8ccad1114f774c71edb1713b70a8e0bbd79f5630d.exe	27

C:\Users\Admin\AppData\Local\Temp\a1f155af8c27e665f9bf21d8ccad1114f774c71edb1713b70a8e0bbd79f5630d.exe
"C:\Users\Admin\AppData\Local\Temp\a1f155af8c27e665f9bf21d8ccad1114f774c71edb1713b70a8e0bbd79f5630d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 36
  2⤵
  - Program crash
  PID:840