4bda0b59cb8a2931a9496930692f7822daa27e0760f937ed7aa174fa8a4f95b9

Analysis

max time kernel
24s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-10-2022 03:36

Target

4bda0b59cb8a2931a9496930692f7822daa27e0760f937ed7aa174fa8a4f95b9.exe
Size

732KB
MD5

930f2353b5a09d61480b62b5e5ce48d0
SHA1

58d705c8221572101fe18bf0d61b0b4572c78849
SHA256

4bda0b59cb8a2931a9496930692f7822daa27e0760f937ed7aa174fa8a4f95b9
SHA512

a3c52a1fa2f35e23d8d8d7da8d18163b4eb438a532fa6e151676b6898c87a1b79395786271228d581d4e38f847f7ba10e190058cb1da6ccec081e1dd31ecde2c
SSDEEP

12288:yz0aEbUAXzlxeJnME05sgK2GWAapfhMrdMqosnrYs0uQFMPbuSSsPdi:yz0a2xjF5sgEW8rdvosnrXLSoo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
316	304	WerFault.exe	21

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 304 wrote to memory of 316	304	4bda0b59cb8a2931a9496930692f7822daa27e0760f937ed7aa174fa8a4f95b9.exe	27
PID 304 wrote to memory of 316	304	4bda0b59cb8a2931a9496930692f7822daa27e0760f937ed7aa174fa8a4f95b9.exe	27
PID 304 wrote to memory of 316	304	4bda0b59cb8a2931a9496930692f7822daa27e0760f937ed7aa174fa8a4f95b9.exe	27
PID 304 wrote to memory of 316	304	4bda0b59cb8a2931a9496930692f7822daa27e0760f937ed7aa174fa8a4f95b9.exe	27

C:\Users\Admin\AppData\Local\Temp\4bda0b59cb8a2931a9496930692f7822daa27e0760f937ed7aa174fa8a4f95b9.exe
"C:\Users\Admin\AppData\Local\Temp\4bda0b59cb8a2931a9496930692f7822daa27e0760f937ed7aa174fa8a4f95b9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 304 -s 200
  2⤵
  - Program crash
  PID:316

memory/304-54-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/304-56-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/316-55-0x0000000000000000-mapping.dmp

Download