a8d05b57132a7f8b819362c86e1fad5f5aaa9670ac6b5322355884bd95c66f27

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 12:30

Target

a8d05b57132a7f8b819362c86e1fad5f5aaa9670ac6b5322355884bd95c66f27.exe
Size

5KB
MD5

bdc5a1c1025ed6facc1aa0a6b2c46a48
SHA1

5be7035f50046c04b422ec58e618742ba86c2df8
SHA256

a8d05b57132a7f8b819362c86e1fad5f5aaa9670ac6b5322355884bd95c66f27
SHA512

42be7226cfd57a1033af4530e2435b877cfc3cfba430baa8e0f6a13e586625ab292a54a87d9a5f9a308313f21ee843bc0a7a023f36a3ae4f5c9c754eaada579a
SSDEEP

48:S3lXWFPpT+dXVfzZh4yMGcKzMEkTaak4PAZivO2pB42pBdvMZL2R7tqRuqSxp:cWLkFfNnOKYloIQ2pm2pbYSexE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3036	2944	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 3036	2944	a8d05b57132a7f8b819362c86e1fad5f5aaa9670ac6b5322355884bd95c66f27.exe	28
PID 2944 wrote to memory of 3036	2944	a8d05b57132a7f8b819362c86e1fad5f5aaa9670ac6b5322355884bd95c66f27.exe	28
PID 2944 wrote to memory of 3036	2944	a8d05b57132a7f8b819362c86e1fad5f5aaa9670ac6b5322355884bd95c66f27.exe	28
PID 2944 wrote to memory of 3036	2944	a8d05b57132a7f8b819362c86e1fad5f5aaa9670ac6b5322355884bd95c66f27.exe	28

C:\Users\Admin\AppData\Local\Temp\a8d05b57132a7f8b819362c86e1fad5f5aaa9670ac6b5322355884bd95c66f27.exe
"C:\Users\Admin\AppData\Local\Temp\a8d05b57132a7f8b819362c86e1fad5f5aaa9670ac6b5322355884bd95c66f27.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 48
  2⤵
  - Program crash
  PID:3036