416f3a7938d3cf92cc653eba76a66a79a56de3741e4707727eca22f8e78d1b87

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 03:24

Target

aae12068472c80ae3dcc55167c546479.exe
Size

368KB
MD5

aae12068472c80ae3dcc55167c546479
SHA1

5e1021c40bef1ea2e3fcabb965dcaf6ee647c5fc
SHA256

416f3a7938d3cf92cc653eba76a66a79a56de3741e4707727eca22f8e78d1b87
SHA512

df2255f0f6cec7ae655ff440221258fee219930e36f5b174c09188ea7d12ccfe7b4f59157638aeaec5f3d06e346655ab1e96a9a121aa49e6e6e76b189a7105a3
SSDEEP

6144:211rg9/dHIm5gx8ISWIrPTka9ZhuGQT2+LwTdSv+qEMxpASjTnri:2c9/um5i8ISpkcxeAF4xpASTi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2220	2236	WerFault.exe	5

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2220	2236	aae12068472c80ae3dcc55167c546479.exe	28
PID 2236 wrote to memory of 2220	2236	aae12068472c80ae3dcc55167c546479.exe	28
PID 2236 wrote to memory of 2220	2236	aae12068472c80ae3dcc55167c546479.exe	28
PID 2236 wrote to memory of 2220	2236	aae12068472c80ae3dcc55167c546479.exe	28

C:\Users\Admin\AppData\Local\Temp\aae12068472c80ae3dcc55167c546479.exe
"C:\Users\Admin\AppData\Local\Temp\aae12068472c80ae3dcc55167c546479.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 116
  2⤵
  - Program crash
  PID:2220

memory/2236-0-0x00000000009C0000-0x0000000000A20000-memory.dmp

Filesize
384KB

Download