1aa05e1ee7baef80f6e90a5c0fc75412e8950526568b815b3b76067b8b76a175

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 07:57

Target

1aa05e1ee7baef80f6e90a5c0fc75412e8950526568b815b3b76067b8b76a175.exe
Size

5KB
MD5

0cf07110fa7fdccdafb29c0d66adfa95
SHA1

dae180109c9a3ff9d6a7faaee4feb890304c406f
SHA256

1aa05e1ee7baef80f6e90a5c0fc75412e8950526568b815b3b76067b8b76a175
SHA512

724bb5e27436784f86a6be535526df437e4bed0708bb8c9f9393270ae15670984ccb34cf8cf4e83cbad56dfe0e87e2f514e9cbf8c4ecb2901a3c3cbb840367cc
SSDEEP

48:S/lXWFPpT+dXVfzZh4yMGcKzMEkTaak4PAZivO2pB42pBdvMZL2R7tNRuqSxp:kWLkFfNnOKYloIQ2pm2pbYSDxE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2644	2436	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2644	2436	1aa05e1ee7baef80f6e90a5c0fc75412e8950526568b815b3b76067b8b76a175.exe	28
PID 2436 wrote to memory of 2644	2436	1aa05e1ee7baef80f6e90a5c0fc75412e8950526568b815b3b76067b8b76a175.exe	28
PID 2436 wrote to memory of 2644	2436	1aa05e1ee7baef80f6e90a5c0fc75412e8950526568b815b3b76067b8b76a175.exe	28
PID 2436 wrote to memory of 2644	2436	1aa05e1ee7baef80f6e90a5c0fc75412e8950526568b815b3b76067b8b76a175.exe	28

C:\Users\Admin\AppData\Local\Temp\1aa05e1ee7baef80f6e90a5c0fc75412e8950526568b815b3b76067b8b76a175.exe
"C:\Users\Admin\AppData\Local\Temp\1aa05e1ee7baef80f6e90a5c0fc75412e8950526568b815b3b76067b8b76a175.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 48
  2⤵
  - Program crash
  PID:2644