4fb21acd5841b45f6fcb3ed8ff413c3128cf263353a315c6dc6838c19c62f2d7

Analysis

max time kernel
39s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 17:28

Target

4fb21acd5841b45f6fcb3ed8ff413c3128cf263353a315c6dc6838c19c62f2d7.exe
Size

1.8MB
MD5

81a526c07fc0d240ecd9007a1e3e3bae
SHA1

fa9d007fb5c5b3c7b2e0fcecc4179b5b869f7b5e
SHA256

4fb21acd5841b45f6fcb3ed8ff413c3128cf263353a315c6dc6838c19c62f2d7
SHA512

b6d64cef517b8ad2ee8a5954adf4c4c7567f11b94e769af75beb2dbf08debad6b93e2c2c6e032922d1a611f4bf748d705bccb119545d1e2a1d3f9e8d469b6b5f
SSDEEP

3072:SF5gf50zPKPbWgGImil4Vs8y2Dqz2gU9a:KgfSCSgGIHl4Vs/2Dqzgk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
940	1980	WerFault.exe	9

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 940	1980	4fb21acd5841b45f6fcb3ed8ff413c3128cf263353a315c6dc6838c19c62f2d7.exe	28
PID 1980 wrote to memory of 940	1980	4fb21acd5841b45f6fcb3ed8ff413c3128cf263353a315c6dc6838c19c62f2d7.exe	28
PID 1980 wrote to memory of 940	1980	4fb21acd5841b45f6fcb3ed8ff413c3128cf263353a315c6dc6838c19c62f2d7.exe	28
PID 1980 wrote to memory of 940	1980	4fb21acd5841b45f6fcb3ed8ff413c3128cf263353a315c6dc6838c19c62f2d7.exe	28

C:\Users\Admin\AppData\Local\Temp\4fb21acd5841b45f6fcb3ed8ff413c3128cf263353a315c6dc6838c19c62f2d7.exe
"C:\Users\Admin\AppData\Local\Temp\4fb21acd5841b45f6fcb3ed8ff413c3128cf263353a315c6dc6838c19c62f2d7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 92
  2⤵
  - Program crash
  PID:940

memory/1980-54-0x0000000000400000-0x00000000005C371C-memory.dmp

Filesize
1.8MB

Download