aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-04-2024 13:19

Target

aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8.exe
Size

52KB
MD5

d8e1495b46cded57eb1423b8bb789834
SHA1

db64bc20550e51c602dbb92d07c8f02842efebcc
SHA256

aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8
SHA512

8b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb
SSDEEP

768:kbx1xSQBLHSq0ItD/hf3aLFLPnWQUQ7x6ziT:kb5SyHRJD/hf3aLlKcxeiT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2080	1252	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 2080	1252	aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8.exe	28
PID 1252 wrote to memory of 2080	1252	aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8.exe	28
PID 1252 wrote to memory of 2080	1252	aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8.exe	28
PID 1252 wrote to memory of 2080	1252	aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8.exe	28

C:\Users\Admin\AppData\Local\Temp\aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8.exe
"C:\Users\Admin\AppData\Local\Temp\aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 44
  2⤵
  - Program crash
  PID:2080

memory/1252-0-0x0000000000F60000-0x0000000000F70000-memory.dmp

Filesize
64KB

Download