a1ba702657370a5196b5104985c841064a5af715edbebdace522fd1b47946fc4

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 10:30

Target

a1ba702657370a5196b5104985c841064a5af715edbebdace522fd1b47946fc4.exe
Size

100KB
MD5

85474578df061beedd82386d0d873aae
SHA1

b7a8afc02c7ffd916511ce4856b5b15401f8a4c5
SHA256

a1ba702657370a5196b5104985c841064a5af715edbebdace522fd1b47946fc4
SHA512

eca5a7a43a4bf2f9d257812def0069225b1b59035e8cdaa8be560d9c2190398296f48c94e8093739e5fc4d1aee03ac8f63e1cc9e007c62a94f2daa12fa58d32c
SSDEEP

1536:f6qkSxsjQbAlQH5hcUb7lZns6LIZorvMqljXzHfoPG0P8dL6hYdBv858KIIsQqHj:ojJeVbA6LsQ3/oPfkfnKIaS/V77

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
980	1696	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 980	1696	a1ba702657370a5196b5104985c841064a5af715edbebdace522fd1b47946fc4.exe	27
PID 1696 wrote to memory of 980	1696	a1ba702657370a5196b5104985c841064a5af715edbebdace522fd1b47946fc4.exe	27
PID 1696 wrote to memory of 980	1696	a1ba702657370a5196b5104985c841064a5af715edbebdace522fd1b47946fc4.exe	27
PID 1696 wrote to memory of 980	1696	a1ba702657370a5196b5104985c841064a5af715edbebdace522fd1b47946fc4.exe	27

C:\Users\Admin\AppData\Local\Temp\a1ba702657370a5196b5104985c841064a5af715edbebdace522fd1b47946fc4.exe
"C:\Users\Admin\AppData\Local\Temp\a1ba702657370a5196b5104985c841064a5af715edbebdace522fd1b47946fc4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 116
  2⤵
  - Program crash
  PID:980

memory/1696-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/1696-56-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download