aa093b67c9e5371bf729388737f71e2d9ff7910e3ea2ae0f5e92186dcd2ea358

Analysis

max time kernel
39s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 09:34

Target

aa093b67c9e5371bf729388737f71e2d9ff7910e3ea2ae0f5e92186dcd2ea358.exe
Size

100KB
MD5

c25de2a309df4abc05cb1f293a41a78e
SHA1

2d1956d60cca7c8d8a685586abdccc998a6f672b
SHA256

aa093b67c9e5371bf729388737f71e2d9ff7910e3ea2ae0f5e92186dcd2ea358
SHA512

4f172063b356cbf6d6b26e7b162a86a9f9cac03d3e978d492d9b96a73c324e337c0f2ea2196363238f4210520cb70ea75ac607dfb03f7abd615bfd72896ab88a
SSDEEP

1536:hyl7wqVUXbBakhnXyeDNf1tDM3nmPUuTHM0mno+cJlId:h4rVgYkhisN7w3nmcuTSnohJlId

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1952	1364	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 1952	1364	aa093b67c9e5371bf729388737f71e2d9ff7910e3ea2ae0f5e92186dcd2ea358.exe	28
PID 1364 wrote to memory of 1952	1364	aa093b67c9e5371bf729388737f71e2d9ff7910e3ea2ae0f5e92186dcd2ea358.exe	28
PID 1364 wrote to memory of 1952	1364	aa093b67c9e5371bf729388737f71e2d9ff7910e3ea2ae0f5e92186dcd2ea358.exe	28
PID 1364 wrote to memory of 1952	1364	aa093b67c9e5371bf729388737f71e2d9ff7910e3ea2ae0f5e92186dcd2ea358.exe	28

C:\Users\Admin\AppData\Local\Temp\aa093b67c9e5371bf729388737f71e2d9ff7910e3ea2ae0f5e92186dcd2ea358.exe
"C:\Users\Admin\AppData\Local\Temp\aa093b67c9e5371bf729388737f71e2d9ff7910e3ea2ae0f5e92186dcd2ea358.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 120
  2⤵
  - Program crash
  PID:1952