ae3ea5ae12361a1ee8e6d7a16d101f0a22492b039e06e5439bfc067c5bd66649

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 01:18

Target

ae3ea5ae12361a1ee8e6d7a16d101f0a22492b039e06e5439bfc067c5bd66649.exe
Size

327KB
MD5

500a46693ea76bfc26f7cfa6a2e84574
SHA1

fef494c31628d42d80e0803a10adbb32476bd317
SHA256

ae3ea5ae12361a1ee8e6d7a16d101f0a22492b039e06e5439bfc067c5bd66649
SHA512

5f7b24086ce20b35e0c4c2615e6d2461fc512ae1bf787dfdcf3a042c374ee101828aaff304fbb1889c667c641954462f995174d4c2961da7d27591b086e28956
SSDEEP

6144:MpdFlmluvoEBobXXF5CqgFuZvJ+I+pn2s5LjHgQcYqZQG6ko:Mp4EBobGWvegUZcf2G6ko

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2272	1712	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2272	1712	ae3ea5ae12361a1ee8e6d7a16d101f0a22492b039e06e5439bfc067c5bd66649.exe	28
PID 1712 wrote to memory of 2272	1712	ae3ea5ae12361a1ee8e6d7a16d101f0a22492b039e06e5439bfc067c5bd66649.exe	28
PID 1712 wrote to memory of 2272	1712	ae3ea5ae12361a1ee8e6d7a16d101f0a22492b039e06e5439bfc067c5bd66649.exe	28
PID 1712 wrote to memory of 2272	1712	ae3ea5ae12361a1ee8e6d7a16d101f0a22492b039e06e5439bfc067c5bd66649.exe	28

C:\Users\Admin\AppData\Local\Temp\ae3ea5ae12361a1ee8e6d7a16d101f0a22492b039e06e5439bfc067c5bd66649.exe
"C:\Users\Admin\AppData\Local\Temp\ae3ea5ae12361a1ee8e6d7a16d101f0a22492b039e06e5439bfc067c5bd66649.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 92
  2⤵
  - Program crash
  PID:2272

memory/1712-0-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download