4d0ea52d8c4e1b9d691d4b0aecc256eef70e4cc883d146ac8f05e15b14f51ecb

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 10:55

Target

4d0ea52d8c4e1b9d691d4b0aecc256eef70e4cc883d146ac8f05e15b14f51ecb.exe
Size

320KB
MD5

a322d97c54d286b7606c0480a368a850
SHA1

f33ba1b477d50a6359bfb14605cd5701158028aa
SHA256

4d0ea52d8c4e1b9d691d4b0aecc256eef70e4cc883d146ac8f05e15b14f51ecb
SHA512

230a65e4f99b34c6287bcd2893f67e4d01e9d0558803b82619868d71ef8d08b879c8ed453c2aebfcbfc9ce0bcfcaa94c43c0d624cb69e7e38fe8be44dac1760b
SSDEEP

6144:kKyB24ivH2RfS155ONNXBuWoJBO9OMbHLkAqF7Ief9UmM7/uT:NyBJU2EB0NxDIBuOFe7/uT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1384	1112	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 1384	1112	4d0ea52d8c4e1b9d691d4b0aecc256eef70e4cc883d146ac8f05e15b14f51ecb.exe	26
PID 1112 wrote to memory of 1384	1112	4d0ea52d8c4e1b9d691d4b0aecc256eef70e4cc883d146ac8f05e15b14f51ecb.exe	26
PID 1112 wrote to memory of 1384	1112	4d0ea52d8c4e1b9d691d4b0aecc256eef70e4cc883d146ac8f05e15b14f51ecb.exe	26
PID 1112 wrote to memory of 1384	1112	4d0ea52d8c4e1b9d691d4b0aecc256eef70e4cc883d146ac8f05e15b14f51ecb.exe	26

C:\Users\Admin\AppData\Local\Temp\4d0ea52d8c4e1b9d691d4b0aecc256eef70e4cc883d146ac8f05e15b14f51ecb.exe
"C:\Users\Admin\AppData\Local\Temp\4d0ea52d8c4e1b9d691d4b0aecc256eef70e4cc883d146ac8f05e15b14f51ecb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 36
  2⤵
  - Program crash
  PID:1384

memory/1112-55-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download