4676b2dae79b9b1ce4d9e753751b626d815be0e43f981ccead6bac54e68ac606

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 22:22

Target

4676b2dae79b9b1ce4d9e753751b626d815be0e43f981ccead6bac54e68ac606.exe
Size

132KB
MD5

0ece77ddd87f55f2cc5f950dde06c156
SHA1

bf2153146e6de36a7f335d623aaca89ee2ef90a3
SHA256

4676b2dae79b9b1ce4d9e753751b626d815be0e43f981ccead6bac54e68ac606
SHA512

5ece92d1bc86067908704f8503edf9a10a48ac0ff019bb0993f47ecdbb1bc2771c3a1909c94ee09f8f0ffa2dd32ef350bc708707e250b20c56b265f691d7d2c7
SSDEEP

3072:jGnBLfORThFfOUBGrGSDADeak7dJHB/A0:j8BL2RTv2UB6GSsQLH5A0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1352	1324	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 1352	1324	4676b2dae79b9b1ce4d9e753751b626d815be0e43f981ccead6bac54e68ac606.exe	27
PID 1324 wrote to memory of 1352	1324	4676b2dae79b9b1ce4d9e753751b626d815be0e43f981ccead6bac54e68ac606.exe	27
PID 1324 wrote to memory of 1352	1324	4676b2dae79b9b1ce4d9e753751b626d815be0e43f981ccead6bac54e68ac606.exe	27
PID 1324 wrote to memory of 1352	1324	4676b2dae79b9b1ce4d9e753751b626d815be0e43f981ccead6bac54e68ac606.exe	27

C:\Users\Admin\AppData\Local\Temp\4676b2dae79b9b1ce4d9e753751b626d815be0e43f981ccead6bac54e68ac606.exe
"C:\Users\Admin\AppData\Local\Temp\4676b2dae79b9b1ce4d9e753751b626d815be0e43f981ccead6bac54e68ac606.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 148
  2⤵
  - Program crash
  PID:1352

memory/1324-55-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1352-54-0x0000000000000000-mapping.dmp

Download