4bd7075cfacf1940c00cb60328ee20190a618d38023e2cb35a302a3903435b5d

Analysis

max time kernel
156s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2022 19:41

Target

4bd7075cfacf1940c00cb60328ee20190a618d38023e2cb35a302a3903435b5d.exe
Size

744KB
MD5

2a5c407e1e79a2291a6920a023eac0c3
SHA1

7ac9bab12fd48ae21f59cdef5bb8e4fdb99f6f89
SHA256

4bd7075cfacf1940c00cb60328ee20190a618d38023e2cb35a302a3903435b5d
SHA512

5204916f50def7bcefebcb2dd33410e7af7ed952f64a3ad2da9cc495be85813d055692d3b469eb5094c0938ecc04d5f70bd9541e9ff824a76c3369661cbd6705
SSDEEP

12288:8hvk3gqRvyIF0uR5vWPz6qQrKfDT3BwhmlI8Aq:gXOWL7zAq

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2132 4064 WerFault.exe

pid	pid_target	process	target process
2132	4064	WerFault.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

4bd7075cfacf1940c00cb60328ee20190a618d38023e2cb35a302a3903435b5d.exe

description	pid	process	target process
PID 2500 wrote to memory of 5000	2500	4bd7075cfacf1940c00cb60328ee20190a618d38023e2cb35a302a3903435b5d.exe	pcaui.exe
PID 2500 wrote to memory of 5000	2500	4bd7075cfacf1940c00cb60328ee20190a618d38023e2cb35a302a3903435b5d.exe	pcaui.exe

C:\Users\Admin\AppData\Local\Temp\4bd7075cfacf1940c00cb60328ee20190a618d38023e2cb35a302a3903435b5d.exe
"C:\Users\Admin\AppData\Local\Temp\4bd7075cfacf1940c00cb60328ee20190a618d38023e2cb35a302a3903435b5d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2500

C:\Windows\system32\pcaui.exe
"C:\Windows\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {60fdc094-58fa-41d5-bd57-5c9bd53e8d92} -a "Daemon Tools" -v "DT Soft Ltd." -s "This app can't run because it causes security or performance issues on Windows. A new version may be available. Check with your software provider for an updated version that runs on this version of Windows." -n 2 -f 616281 -k 0 -e "C:\Users\Admin\AppData\Local\Temp\4bd7075cfacf1940c00cb60328ee20190a618d38023e2cb35a302a3903435b5d.exe"
2⤵
PID:5000

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 444 -p 4064 -ip 4064
1⤵
PID:3480

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4064 -s 1764
1⤵
- Program crash
PID:2132