a3f6ecef5dceec72bb85b4ce266bef0716b2580c7964027d82a0177bc116d520

Analysis

max time kernel
104s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
09/02/2023, 02:21

Target

a3f6ecef5dceec72bb85b4ce266bef0716b2580c7964027d82a0177bc116d520.exe
Size

88KB
MD5

157deab463aefb061b6a1f5ce30fea57
SHA1

6704e968a6d8eddcf748033b0cb57d5b2ef79803
SHA256

a3f6ecef5dceec72bb85b4ce266bef0716b2580c7964027d82a0177bc116d520
SHA512

a567d02f444080a7dd3de9cd4129f9fc26fab5ad3aa9fe2da2ab7e79abb3353a52f5fd00adec69c51f24551a6d6324b2444315de69fa1563dc9a194db2156b95
SSDEEP

1536:N11qUgg1XPbDXtYXRbAetK08FUUpDSy8DPF6TT2ctW:P6bltK0OUeyDPMlt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1912	952	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 1912	952	a3f6ecef5dceec72bb85b4ce266bef0716b2580c7964027d82a0177bc116d520.exe	28
PID 952 wrote to memory of 1912	952	a3f6ecef5dceec72bb85b4ce266bef0716b2580c7964027d82a0177bc116d520.exe	28
PID 952 wrote to memory of 1912	952	a3f6ecef5dceec72bb85b4ce266bef0716b2580c7964027d82a0177bc116d520.exe	28
PID 952 wrote to memory of 1912	952	a3f6ecef5dceec72bb85b4ce266bef0716b2580c7964027d82a0177bc116d520.exe	28

C:\Users\Admin\AppData\Local\Temp\a3f6ecef5dceec72bb85b4ce266bef0716b2580c7964027d82a0177bc116d520.exe
"C:\Users\Admin\AppData\Local\Temp\a3f6ecef5dceec72bb85b4ce266bef0716b2580c7964027d82a0177bc116d520.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 96
  2⤵
  - Program crash
  PID:1912