45a54d69ac1009453aef6db08ecaafece0bb84e07904ff2e26fb23ce8f91c7be

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 19:31

Target

45a54d69ac1009453aef6db08ecaafece0bb84e07904ff2e26fb23ce8f91c7be.exe
Size

56KB
MD5

0f49c907007a82d8eba1e02f6216001a
SHA1

fbda8bbd22c0ebda4c630c1e6bbdc7bac4849c24
SHA256

45a54d69ac1009453aef6db08ecaafece0bb84e07904ff2e26fb23ce8f91c7be
SHA512

73d96a61970027c4393e8d7baeaf5b41e2457149f65c2c499b151a19f088303789284fab96a4833df6856f3b1f4b22b177501ab6c1f596b11cd75211f917c43a
SSDEEP

1536:wvUt9n43R6PNvJH7ola5ljykecjzBhknqTgK:+GZIIPNvJH7mwThJhkqv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1988	1808	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 1988	1808	45a54d69ac1009453aef6db08ecaafece0bb84e07904ff2e26fb23ce8f91c7be.exe	27
PID 1808 wrote to memory of 1988	1808	45a54d69ac1009453aef6db08ecaafece0bb84e07904ff2e26fb23ce8f91c7be.exe	27
PID 1808 wrote to memory of 1988	1808	45a54d69ac1009453aef6db08ecaafece0bb84e07904ff2e26fb23ce8f91c7be.exe	27
PID 1808 wrote to memory of 1988	1808	45a54d69ac1009453aef6db08ecaafece0bb84e07904ff2e26fb23ce8f91c7be.exe	27

C:\Users\Admin\AppData\Local\Temp\45a54d69ac1009453aef6db08ecaafece0bb84e07904ff2e26fb23ce8f91c7be.exe
"C:\Users\Admin\AppData\Local\Temp\45a54d69ac1009453aef6db08ecaafece0bb84e07904ff2e26fb23ce8f91c7be.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 36
  2⤵
  - Program crash
  PID:1988

memory/1808-54-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download