f45b4103c8af2089a83b7be125aad682d68e12c7bb0a6400a7bd5fdec497dc71

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 05:39

Target

f45b4103c8af2089a83b7be125aad682d68e12c7bb0a6400a7bd5fdec497dc71.exe
Size

111KB
MD5

6a869267da9f9b0fd3bead86a0c4103a
SHA1

8494f28b46f3895e68095f78e3fa5d26b34a8ab5
SHA256

f45b4103c8af2089a83b7be125aad682d68e12c7bb0a6400a7bd5fdec497dc71
SHA512

adddf6234c1fa606b8dce8b9f0e5d8a85a702bd92d63e5657f606ac9ec06466664d318bda568e76c3a4ed7562a35074f653b785e3c36770876ababa071dc4d61
SSDEEP

1536:GjdXiqpbYBVz5Kiek7tE272jEaVIM/ay5edspZCA:K3FYn5KieKR8Z5edkd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1692	1128	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 1692	1128	f45b4103c8af2089a83b7be125aad682d68e12c7bb0a6400a7bd5fdec497dc71.exe	27
PID 1128 wrote to memory of 1692	1128	f45b4103c8af2089a83b7be125aad682d68e12c7bb0a6400a7bd5fdec497dc71.exe	27
PID 1128 wrote to memory of 1692	1128	f45b4103c8af2089a83b7be125aad682d68e12c7bb0a6400a7bd5fdec497dc71.exe	27
PID 1128 wrote to memory of 1692	1128	f45b4103c8af2089a83b7be125aad682d68e12c7bb0a6400a7bd5fdec497dc71.exe	27

C:\Users\Admin\AppData\Local\Temp\f45b4103c8af2089a83b7be125aad682d68e12c7bb0a6400a7bd5fdec497dc71.exe
"C:\Users\Admin\AppData\Local\Temp\f45b4103c8af2089a83b7be125aad682d68e12c7bb0a6400a7bd5fdec497dc71.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 168
  2⤵
  - Program crash
  PID:1692

memory/1128-54-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download
memory/1128-55-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download