046c4f63d8bdc335f50371b8c917936044af1d42d7aeaa03b90fc7a4c0ae3930

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 12:09

Target

046c4f63d8bdc335f50371b8c917936044af1d42d7aeaa03b90fc7a4c0ae3930.exe
Size

152KB
MD5

217c74f712cbaca2f63c45641655a420
SHA1

417931c3cfebaeb585132b96f17870a4de30dbbc
SHA256

046c4f63d8bdc335f50371b8c917936044af1d42d7aeaa03b90fc7a4c0ae3930
SHA512

ac163582b52a5738d9c54ce6b5e361d7ee417267434b31b814142b8473ba4e62ebe3c37f69a41d79d558536e7949324df069f6610d796f7e5f7896894621b392
SSDEEP

3072:MFmsZooQhWiDReZWiDRerSDADeak7dJHB/AdG3:8yoiVZiVaSsQLH5AdU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1116	1128	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 1116	1128	046c4f63d8bdc335f50371b8c917936044af1d42d7aeaa03b90fc7a4c0ae3930.exe	27
PID 1128 wrote to memory of 1116	1128	046c4f63d8bdc335f50371b8c917936044af1d42d7aeaa03b90fc7a4c0ae3930.exe	27
PID 1128 wrote to memory of 1116	1128	046c4f63d8bdc335f50371b8c917936044af1d42d7aeaa03b90fc7a4c0ae3930.exe	27
PID 1128 wrote to memory of 1116	1128	046c4f63d8bdc335f50371b8c917936044af1d42d7aeaa03b90fc7a4c0ae3930.exe	27

C:\Users\Admin\AppData\Local\Temp\046c4f63d8bdc335f50371b8c917936044af1d42d7aeaa03b90fc7a4c0ae3930.exe
"C:\Users\Admin\AppData\Local\Temp\046c4f63d8bdc335f50371b8c917936044af1d42d7aeaa03b90fc7a4c0ae3930.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 36
  2⤵
  - Program crash
  PID:1116

memory/1128-55-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download