a1fafe317ab68bf834269176a32aef67f45ea1f33750df0a278d586317c852cb

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 01:35

Target

a1fafe317ab68bf834269176a32aef67f45ea1f33750df0a278d586317c852cb.exe
Size

891KB
MD5

78bb5e1866bdf1f6d1040ef751766671
SHA1

5a08b1faeb0dcd0722710e9e6a04aeca234fc140
SHA256

a1fafe317ab68bf834269176a32aef67f45ea1f33750df0a278d586317c852cb
SHA512

b801c460a8658a8d92d6d52d27a3e06a5a5936f6b4282aaaec6da894cd48a6e29b521608ad55ff18721a018b9afaf7be6641e59061560867b72ddbd2773641c7
SSDEEP

12288:D8OdZr0bzuKlW5nkTzukTUSez2fOSRfd2CXCpL+Db5Eak4TOAeBMe:D8W0bzNlkSez2f7fd2mCVm5EajTOHX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1228	2992	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 1228	2992	a1fafe317ab68bf834269176a32aef67f45ea1f33750df0a278d586317c852cb.exe	28
PID 2992 wrote to memory of 1228	2992	a1fafe317ab68bf834269176a32aef67f45ea1f33750df0a278d586317c852cb.exe	28
PID 2992 wrote to memory of 1228	2992	a1fafe317ab68bf834269176a32aef67f45ea1f33750df0a278d586317c852cb.exe	28
PID 2992 wrote to memory of 1228	2992	a1fafe317ab68bf834269176a32aef67f45ea1f33750df0a278d586317c852cb.exe	28

C:\Users\Admin\AppData\Local\Temp\a1fafe317ab68bf834269176a32aef67f45ea1f33750df0a278d586317c852cb.exe
"C:\Users\Admin\AppData\Local\Temp\a1fafe317ab68bf834269176a32aef67f45ea1f33750df0a278d586317c852cb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 52
  2⤵
  - Program crash
  PID:1228

memory/2992-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2992-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download