4cf639f71d7f3423d995f5333871b13c0f3dd84b7be2e8d03198b9f0dd55447d

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 08:58

Target

4cf639f71d7f3423d995f5333871b13c0f3dd84b7be2e8d03198b9f0dd55447d.exe
Size

42KB
MD5

15deec508d5831edc29c1a1c4074e161
SHA1

d966afb4fcef4e1b179e2941c1b5d80f4d3affa5
SHA256

4cf639f71d7f3423d995f5333871b13c0f3dd84b7be2e8d03198b9f0dd55447d
SHA512

3b1db4f5675950a1e8814bdc4d2b73c5e67fb2ae77d337ae76839fcf9cdcd3387ac215c2cc2b7da2306f57ec440c95ed828a26cee2233ae7bc60e0f0945bfc5c
SSDEEP

384:raYudbzCbr3O0ueSP3TG8rjgekaZFY3nHhs94fOlb+zmzG0Kq6x6ahJipiSldk:zu2VSPTZrjRFknHhq6bRxphJis22

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
368	1684	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 368	1684	4cf639f71d7f3423d995f5333871b13c0f3dd84b7be2e8d03198b9f0dd55447d.exe	27
PID 1684 wrote to memory of 368	1684	4cf639f71d7f3423d995f5333871b13c0f3dd84b7be2e8d03198b9f0dd55447d.exe	27
PID 1684 wrote to memory of 368	1684	4cf639f71d7f3423d995f5333871b13c0f3dd84b7be2e8d03198b9f0dd55447d.exe	27
PID 1684 wrote to memory of 368	1684	4cf639f71d7f3423d995f5333871b13c0f3dd84b7be2e8d03198b9f0dd55447d.exe	27

C:\Users\Admin\AppData\Local\Temp\4cf639f71d7f3423d995f5333871b13c0f3dd84b7be2e8d03198b9f0dd55447d.exe
"C:\Users\Admin\AppData\Local\Temp\4cf639f71d7f3423d995f5333871b13c0f3dd84b7be2e8d03198b9f0dd55447d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 36
  2⤵
  - Program crash
  PID:368