0a70e8f17abf24d1a858896728fc69a8eb05a2230e1f51ba4c9584347b437e45

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
23-10-2023 11:29

Target

0a70e8f17abf24d1a858896728fc69a8eb05a2230e1f51ba4c9584347b437e45.exe
Size

4.0MB
MD5

b9be13e6bddd9ce3023a73bd518ce13a
SHA1

2680da3e5aa6f9d7450148f39de4f22b61d43caa
SHA256

0a70e8f17abf24d1a858896728fc69a8eb05a2230e1f51ba4c9584347b437e45
SHA512

0c9c53f8a7698a1f27cea3b3aadf35d7fdc8f5c6c1aebf4ddff3ec2dd1004b0e03a2465c5cbe452583aaa10c1690984c7dd0557ba11df38ce87dad8887099688
SSDEEP

49152:kZpYh913uGgLA/3sflVa71r/0O4QP3AxwHyIezDXTrU8hTWIpgQ432w:kI/QLA/slVMrsOXKwHyI3S9Xw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2644	2476	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2644	2476	0a70e8f17abf24d1a858896728fc69a8eb05a2230e1f51ba4c9584347b437e45.exe	28
PID 2476 wrote to memory of 2644	2476	0a70e8f17abf24d1a858896728fc69a8eb05a2230e1f51ba4c9584347b437e45.exe	28
PID 2476 wrote to memory of 2644	2476	0a70e8f17abf24d1a858896728fc69a8eb05a2230e1f51ba4c9584347b437e45.exe	28
PID 2476 wrote to memory of 2644	2476	0a70e8f17abf24d1a858896728fc69a8eb05a2230e1f51ba4c9584347b437e45.exe	28

C:\Users\Admin\AppData\Local\Temp\0a70e8f17abf24d1a858896728fc69a8eb05a2230e1f51ba4c9584347b437e45.exe
"C:\Users\Admin\AppData\Local\Temp\0a70e8f17abf24d1a858896728fc69a8eb05a2230e1f51ba4c9584347b437e45.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 176
  2⤵
  - Program crash
  PID:2644

memory/2476-0-0x0000000000180000-0x0000000000598000-memory.dmp

Filesize
4.1MB

Download
memory/2476-1-0x0000000000180000-0x0000000000598000-memory.dmp

Filesize
4.1MB

Download