af105e918014d7b703911e6145ca64311d8d0ff0205712c4e8495d5e38af285d

Analysis

max time kernel
122s
max time network
155s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-04-2024 22:38

Target

af105e918014d7b703911e6145ca64311d8d0ff0205712c4e8495d5e38af285d.exe
Size

612KB
MD5

a78693bd4e5d127330f19e1667b5e05a
SHA1

1e9ea163d0b016afdaa74b42d8e55b734f39754c
SHA256

af105e918014d7b703911e6145ca64311d8d0ff0205712c4e8495d5e38af285d
SHA512

b8d9166d2dad3b63b7303b0267ddd32b876d65fb321edc7399ddd4977abad88b286f0d9ce4e9517a8e29bf92832f154571e28c74f6f55ae702993fae38819dda
SSDEEP

3072:dCaoAs101Pol0xPTM7mRCAdJSSxPUkl3VvMQTCk/dN92sdNhavtrVdewnAx3wmVR:dqDAwl0xPTMiR9JSSxPUKbdodHKafg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2152	2884	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2152	2884	af105e918014d7b703911e6145ca64311d8d0ff0205712c4e8495d5e38af285d.exe	28
PID 2884 wrote to memory of 2152	2884	af105e918014d7b703911e6145ca64311d8d0ff0205712c4e8495d5e38af285d.exe	28
PID 2884 wrote to memory of 2152	2884	af105e918014d7b703911e6145ca64311d8d0ff0205712c4e8495d5e38af285d.exe	28
PID 2884 wrote to memory of 2152	2884	af105e918014d7b703911e6145ca64311d8d0ff0205712c4e8495d5e38af285d.exe	28

C:\Users\Admin\AppData\Local\Temp\af105e918014d7b703911e6145ca64311d8d0ff0205712c4e8495d5e38af285d.exe
"C:\Users\Admin\AppData\Local\Temp\af105e918014d7b703911e6145ca64311d8d0ff0205712c4e8495d5e38af285d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 36
  2⤵
  - Program crash
  PID:2152