1c13de81c17d581a0193d21632542fae01c4ca9b99bfe662684a1a36e012abdb

Analysis

max time kernel
26s
max time network
30s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
09/07/2023, 09:14

Target

a7a46d965bc7b8exeexeexeex.exe
Size

186KB
MD5

a7a46d965bc7b87be9a15f3ce5f37c68
SHA1

0992aa9f39102ec74b665caab57416c33b5dbd2c
SHA256

1c13de81c17d581a0193d21632542fae01c4ca9b99bfe662684a1a36e012abdb
SHA512

bb5bfa7b24ac2b557bf811e902d4c193eb499365ba693b7255de0e1c4964fc17c3e2c09ccde96489e4ee9a77999839a6ab5fdd1dd5c71206775d33528651ad0e
SSDEEP

3072:i/jQeiOl2qNXSGCryn6/IXzJIly0UkXU7wWYA+hDN77x:i/0rOEwXSLrynBDl0UD7NwRB7x

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2312	2232	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2312	2232	a7a46d965bc7b8exeexeexeex.exe	28
PID 2232 wrote to memory of 2312	2232	a7a46d965bc7b8exeexeexeex.exe	28
PID 2232 wrote to memory of 2312	2232	a7a46d965bc7b8exeexeexeex.exe	28
PID 2232 wrote to memory of 2312	2232	a7a46d965bc7b8exeexeexeex.exe	28

C:\Users\Admin\AppData\Local\Temp\a7a46d965bc7b8exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\a7a46d965bc7b8exeexeexeex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 36
  2⤵
  - Program crash
  PID:2312

memory/2232-54-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download