ddb0aa14f00f562d9e8a3356fded94ee24d458a6fe11269df63ec6844274e43c

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
10/04/2023, 06:06

Target

1014/3346a27bd201cb33b49ea9f769f003ec8126b46a299aae4c4b096682f2f675e9.exe
Size

8KB
MD5

90bfe50257437f0a580ec7077dfa8555
SHA1

712735363da21a29025f4bab8ab2865fef609968
SHA256

3346a27bd201cb33b49ea9f769f003ec8126b46a299aae4c4b096682f2f675e9
SHA512

8ffe679945dd259db8a272047914dfbf813aa9e8323f454ead94aabbadaadaaa2b3fd316eee37e84910dd490a8ba3e792259165bfaea391ac7d3d6c6c448e603
SSDEEP

96:BSHncXFci21eyZxrOflYfGKWAuLTaFmfKALuewj/xRrTiH9:gHVjrk7AuL+FwKAAj/XvC9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1360	1740	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 1360	1740	3346a27bd201cb33b49ea9f769f003ec8126b46a299aae4c4b096682f2f675e9.exe	28
PID 1740 wrote to memory of 1360	1740	3346a27bd201cb33b49ea9f769f003ec8126b46a299aae4c4b096682f2f675e9.exe	28
PID 1740 wrote to memory of 1360	1740	3346a27bd201cb33b49ea9f769f003ec8126b46a299aae4c4b096682f2f675e9.exe	28
PID 1740 wrote to memory of 1360	1740	3346a27bd201cb33b49ea9f769f003ec8126b46a299aae4c4b096682f2f675e9.exe	28

C:\Users\Admin\AppData\Local\Temp\1014\3346a27bd201cb33b49ea9f769f003ec8126b46a299aae4c4b096682f2f675e9.exe
"C:\Users\Admin\AppData\Local\Temp\1014\3346a27bd201cb33b49ea9f769f003ec8126b46a299aae4c4b096682f2f675e9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 144
  2⤵
  - Program crash
  PID:1360