a4cfee4aec9c5d176df397bee9db9a0595ebf0f22347ca7bf4ee84bd03e9f219

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 13:37 UTC

Target

a4cfee4aec9c5d176df397bee9db9a0595ebf0f22347ca7bf4ee84bd03e9f219.exe
Size

683KB
MD5

78541359bac96398bc08ba7753ddcfe0
SHA1

a353a7446cf1b5f0a1b7eb011a19d5fbdd798d72
SHA256

a4cfee4aec9c5d176df397bee9db9a0595ebf0f22347ca7bf4ee84bd03e9f219
SHA512

4e6ef1c4c22000463c02bac20c8cde29bc1e3951d85ce2cd609c539a8ec9fb58e7c64bbd282488b5d19eac3640f0ff1daf6fd3198a3b8e09e902aa8bd359d30d
SSDEEP

12288:nK1Kzyl+Pquhnsq5GOgnOXXqt95b/Jr6z9jFnLG5o8ekrfaQ+G5SzOec9UKFh9mp:nK4ul+Pquhnsq5GOgnOXXqt95bV5o8ex

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1704	1464	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 1704	1464	a4cfee4aec9c5d176df397bee9db9a0595ebf0f22347ca7bf4ee84bd03e9f219.exe	26
PID 1464 wrote to memory of 1704	1464	a4cfee4aec9c5d176df397bee9db9a0595ebf0f22347ca7bf4ee84bd03e9f219.exe	26
PID 1464 wrote to memory of 1704	1464	a4cfee4aec9c5d176df397bee9db9a0595ebf0f22347ca7bf4ee84bd03e9f219.exe	26
PID 1464 wrote to memory of 1704	1464	a4cfee4aec9c5d176df397bee9db9a0595ebf0f22347ca7bf4ee84bd03e9f219.exe	26

C:\Users\Admin\AppData\Local\Temp\a4cfee4aec9c5d176df397bee9db9a0595ebf0f22347ca7bf4ee84bd03e9f219.exe
"C:\Users\Admin\AppData\Local\Temp\a4cfee4aec9c5d176df397bee9db9a0595ebf0f22347ca7bf4ee84bd03e9f219.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 528
  2⤵
  - Program crash
  PID:1704

memory/1464-54-0x0000000000E70000-0x0000000000F20000-memory.dmp

Filesize
704KB

Download