ab81223c4fa69c6731863389d400591d853fecb6b9336c4d391e96466d225547

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/02/2024, 15:32

Target

ab81223c4fa69c6731863389d400591d853fecb6b9336c4d391e96466d225547.exe
Size

5KB
MD5

9f75caaddb0f4adb8318d1a73b34207d
SHA1

4fa6df897779fe6bfbe6e8462ce1057321ca552f
SHA256

ab81223c4fa69c6731863389d400591d853fecb6b9336c4d391e96466d225547
SHA512

e7a667815b6f44572b28d1616c5db4f0aade4accd9aa9e58edef2dade06327618b497017724a971ca370b6fbb008ca9ed40d00aa1a0be4f05e3b6e29339cf9c9
SSDEEP

48:SSlXWFPpT+dXVfzZh4yMGcKzMEkTaak4PAZivO2pB42pBdvMZL2R7t2BRuqSxp:XWLkFfNnOKYloIQ2pm2pbYS0xE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2756	2036	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2756	2036	ab81223c4fa69c6731863389d400591d853fecb6b9336c4d391e96466d225547.exe	28
PID 2036 wrote to memory of 2756	2036	ab81223c4fa69c6731863389d400591d853fecb6b9336c4d391e96466d225547.exe	28
PID 2036 wrote to memory of 2756	2036	ab81223c4fa69c6731863389d400591d853fecb6b9336c4d391e96466d225547.exe	28
PID 2036 wrote to memory of 2756	2036	ab81223c4fa69c6731863389d400591d853fecb6b9336c4d391e96466d225547.exe	28

C:\Users\Admin\AppData\Local\Temp\ab81223c4fa69c6731863389d400591d853fecb6b9336c4d391e96466d225547.exe
"C:\Users\Admin\AppData\Local\Temp\ab81223c4fa69c6731863389d400591d853fecb6b9336c4d391e96466d225547.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 48
  2⤵
  - Program crash
  PID:2756