4fc5706694817969f024accafdff8f2b53fbe823c33698699aa78d159e539fc2

Analysis

max time kernel
32s
max time network
39s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 04:09

Target

4fc5706694817969f024accafdff8f2b53fbe823c33698699aa78d159e539fc2.exe
Size

145KB
MD5

5610f396d8fc1acc51668d09af0e7640
SHA1

9bd6415daa82ff652c64468b38db419a9b8f9d6a
SHA256

4fc5706694817969f024accafdff8f2b53fbe823c33698699aa78d159e539fc2
SHA512

c77cedb29795d93fa1dd370e19edd068d18e1020657822d9a806472452cf52e6ba9e9edcd3fd418af33393fd082c1139835a32933b8f8ea409e10610cfa39096
SSDEEP

3072:JLsVRmptxq3aw6RYraBIpPQMPozgEAQIIOt6:JqRmvxEawpraBCDorABt6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1604	1260	WerFault.exe	26

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 1604	1260	4fc5706694817969f024accafdff8f2b53fbe823c33698699aa78d159e539fc2.exe	27
PID 1260 wrote to memory of 1604	1260	4fc5706694817969f024accafdff8f2b53fbe823c33698699aa78d159e539fc2.exe	27
PID 1260 wrote to memory of 1604	1260	4fc5706694817969f024accafdff8f2b53fbe823c33698699aa78d159e539fc2.exe	27
PID 1260 wrote to memory of 1604	1260	4fc5706694817969f024accafdff8f2b53fbe823c33698699aa78d159e539fc2.exe	27
PID 1260 wrote to memory of 1604	1260	4fc5706694817969f024accafdff8f2b53fbe823c33698699aa78d159e539fc2.exe	27
PID 1260 wrote to memory of 1604	1260	4fc5706694817969f024accafdff8f2b53fbe823c33698699aa78d159e539fc2.exe	27
PID 1260 wrote to memory of 1604	1260	4fc5706694817969f024accafdff8f2b53fbe823c33698699aa78d159e539fc2.exe	27

C:\Users\Admin\AppData\Local\Temp\4fc5706694817969f024accafdff8f2b53fbe823c33698699aa78d159e539fc2.exe
"C:\Users\Admin\AppData\Local\Temp\4fc5706694817969f024accafdff8f2b53fbe823c33698699aa78d159e539fc2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 268
  2⤵
  - Program crash
  PID:1604

memory/1260-54-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

Filesize
8KB

Download
memory/1260-55-0x0000000000400000-0x00000000004541F2-memory.dmp

Filesize
336KB

Download
memory/1260-56-0x00000000003A0000-0x00000000003F5000-memory.dmp

Filesize
340KB

Download
memory/1260-58-0x0000000000400000-0x00000000004541F2-memory.dmp

Filesize
336KB

Download