a619648229e17f0b105266cf8c44c6ee3aedc2ea4cd666ae51692e524b347cd9

Analysis

max time kernel
50s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 14:46

Target

a619648229e17f0b105266cf8c44c6ee3aedc2ea4cd666ae51692e524b347cd9.exe
Size

54KB
MD5

a63f604c822404c8dab65fb439f00828
SHA1

4c05b5d3405f11a383314d812022a5cd88e458c1
SHA256

a619648229e17f0b105266cf8c44c6ee3aedc2ea4cd666ae51692e524b347cd9
SHA512

3aeffdd6f049e3a3230f97dc2ad2c8b21eec8a29ec236eca7f0a1336d435a4b94cab1053cc9ab81885a6fd740644c92c4579e75a7de23437971dfab21971b1f8
SSDEEP

1536:X9aciYfH1Tt7/rzrfEqDG7q9PubDY8x8c:Xw6NhPzrc77OWw8x8c

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1696	1744	WerFault.exe	21

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 1696	1744	a619648229e17f0b105266cf8c44c6ee3aedc2ea4cd666ae51692e524b347cd9.exe	28
PID 1744 wrote to memory of 1696	1744	a619648229e17f0b105266cf8c44c6ee3aedc2ea4cd666ae51692e524b347cd9.exe	28
PID 1744 wrote to memory of 1696	1744	a619648229e17f0b105266cf8c44c6ee3aedc2ea4cd666ae51692e524b347cd9.exe	28
PID 1744 wrote to memory of 1696	1744	a619648229e17f0b105266cf8c44c6ee3aedc2ea4cd666ae51692e524b347cd9.exe	28

C:\Users\Admin\AppData\Local\Temp\a619648229e17f0b105266cf8c44c6ee3aedc2ea4cd666ae51692e524b347cd9.exe
"C:\Users\Admin\AppData\Local\Temp\a619648229e17f0b105266cf8c44c6ee3aedc2ea4cd666ae51692e524b347cd9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 144
  2⤵
  - Program crash
  PID:1696