c458291c0bc29103f36dddfabae509600c94049f435eaf239d5c32c0539d4422

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 19:42

Target

c458291c0bc29103f36dddfabae509600c94049f435eaf239d5c32c0539d4422.exe
Size

320KB
MD5

a1b003da6173766a5c3975e8abf544d0
SHA1

9154c3b7623732102a11620483887bc81b282ce0
SHA256

c458291c0bc29103f36dddfabae509600c94049f435eaf239d5c32c0539d4422
SHA512

d30d44faf4a5108a653b05f71d09a3cba9e719212d2e6e5c35165b03f01e52505824be4604d88725fd6dfdd69eb48b1eeacce4042423afb3a439434ec2c143ce
SSDEEP

6144:4Sf5yk94DH2RfS155ONNXBuWoJBO9OMbHLkAqF7Ief9UmM7/uT:4SRyg4r2EB0NxDIBuOFe7/uT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1344	1204	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1344	1204	c458291c0bc29103f36dddfabae509600c94049f435eaf239d5c32c0539d4422.exe	27
PID 1204 wrote to memory of 1344	1204	c458291c0bc29103f36dddfabae509600c94049f435eaf239d5c32c0539d4422.exe	27
PID 1204 wrote to memory of 1344	1204	c458291c0bc29103f36dddfabae509600c94049f435eaf239d5c32c0539d4422.exe	27
PID 1204 wrote to memory of 1344	1204	c458291c0bc29103f36dddfabae509600c94049f435eaf239d5c32c0539d4422.exe	27

C:\Users\Admin\AppData\Local\Temp\c458291c0bc29103f36dddfabae509600c94049f435eaf239d5c32c0539d4422.exe
"C:\Users\Admin\AppData\Local\Temp\c458291c0bc29103f36dddfabae509600c94049f435eaf239d5c32c0539d4422.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 36
  2⤵
  - Program crash
  PID:1344

memory/1204-55-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download