4afc08de58208440be75852daa3f54960f72b9a403af7b3810508b1ad1ee0bc2

Analysis

max time kernel
155s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-10-2022 23:22

Target

4afc08de58208440be75852daa3f54960f72b9a403af7b3810508b1ad1ee0bc2.exe
Size

484KB
MD5

61dd82f9aa5595e09ea218b458df81c0
SHA1

d69952c9e5fc8c26a8f2476422317de14115e0e8
SHA256

4afc08de58208440be75852daa3f54960f72b9a403af7b3810508b1ad1ee0bc2
SHA512

b0d42e7714d3b47607f5a5a394a9f08993c8f1744d04317519e926f241e6abb900f3e1f275659364193f260fd750a4ad6e0ddd9b716151f378fd810f63dc6899
SSDEEP

12288:IUulHqKFNa8kEkkHQWA5SUV+bFhbSsPd9:MEEWWA5TqLSob

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1496	1940	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 1496	1940	4afc08de58208440be75852daa3f54960f72b9a403af7b3810508b1ad1ee0bc2.exe	26
PID 1940 wrote to memory of 1496	1940	4afc08de58208440be75852daa3f54960f72b9a403af7b3810508b1ad1ee0bc2.exe	26
PID 1940 wrote to memory of 1496	1940	4afc08de58208440be75852daa3f54960f72b9a403af7b3810508b1ad1ee0bc2.exe	26
PID 1940 wrote to memory of 1496	1940	4afc08de58208440be75852daa3f54960f72b9a403af7b3810508b1ad1ee0bc2.exe	26

C:\Users\Admin\AppData\Local\Temp\4afc08de58208440be75852daa3f54960f72b9a403af7b3810508b1ad1ee0bc2.exe
"C:\Users\Admin\AppData\Local\Temp\4afc08de58208440be75852daa3f54960f72b9a403af7b3810508b1ad1ee0bc2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 196
  2⤵
  - Program crash
  PID:1496

memory/1940-54-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/1940-55-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/1940-57-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download