0aefa3226697edb8c45682dd5c5feaee4ac2bbfcb07d724b31302a2d4de4dec6

Analysis

max time kernel
54s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 17:48

Target
file.exe
Size 1.4MB
Sample221204-wdevtsbh49
SHA256 0aefa3226697edb8c45682dd5c5feaee4ac2bbfcb07d724b31302a2d4de4dec6
MD5 88ea9619c53d10917b213b4a118e5a03
SHA1 7e6dbd95662af6fcd1f850d8ece093db398409ae
SHA512 08b5e8f2297dcdb89ecb92068ab8b1cf2eb2a8bd012a381946874faffab66ced60f5a114a2cd75a2b80091eaef2f3d2fd2a6c1d1cefeaa1a26df7e97b62baaf1
SSDEEP 24576:14XmDsgZOD0RNDXHu4ip4wLB0dx2HC5gPFDdGLJkHLvpaPZk+veUELxUOgO/Q8n5:NDsgUDMNbOL4wLB0dsx9dIJkHLhaPKko
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1608	1696	WerFault.exe	18

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 1608	1696	file.exe	27
PID 1696 wrote to memory of 1608	1696	file.exe	27
PID 1696 wrote to memory of 1608	1696	file.exe	27
PID 1696 wrote to memory of 1608	1696	file.exe	27

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 120
  2⤵
  - Program crash
  PID:1608