4d9eb93c585d060718901a1aec7a5528bb27e37efea791cdb1fc40e17458b228

Analysis

max time kernel
65s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:44

Target

4d9eb93c585d060718901a1aec7a5528bb27e37efea791cdb1fc40e17458b228.exe
Size

361KB
MD5

5be19bbad857e72d3821a22ebdbcc84a
SHA1

8828800df6d7e4acf8b5b62ad2b45940fbf2a694
SHA256

4d9eb93c585d060718901a1aec7a5528bb27e37efea791cdb1fc40e17458b228
SHA512

0a6cd6de94e1293c669c2a52ec3fd7eb560ec0cd1d27f4cd7f49635805e3e26ae433742d7918044f789ca969b0918b811fd12b83af8b6fd192778c147fdbe681
SSDEEP

6144:gNVsBdozMiaNA5AI2dcD0TnElPWPAHQTb8Xflv5lEUYE:KBzMlOR2dcDGnERWPAj55eUYE

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1476 1480 WerFault.exe 4d9eb93c585d060718901a1aec7a5528bb27e37efea791cdb1fc40e17458b228.exe

pid	pid_target	process	target process
1476	1480	WerFault.exe	4d9eb93c585d060718901a1aec7a5528bb27e37efea791cdb1fc40e17458b228.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4d9eb93c585d060718901a1aec7a5528bb27e37efea791cdb1fc40e17458b228.exe

description	pid	process	target process
PID 1480 wrote to memory of 1476	1480	4d9eb93c585d060718901a1aec7a5528bb27e37efea791cdb1fc40e17458b228.exe	WerFault.exe
PID 1480 wrote to memory of 1476	1480	4d9eb93c585d060718901a1aec7a5528bb27e37efea791cdb1fc40e17458b228.exe	WerFault.exe
PID 1480 wrote to memory of 1476	1480	4d9eb93c585d060718901a1aec7a5528bb27e37efea791cdb1fc40e17458b228.exe	WerFault.exe
PID 1480 wrote to memory of 1476	1480	4d9eb93c585d060718901a1aec7a5528bb27e37efea791cdb1fc40e17458b228.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4d9eb93c585d060718901a1aec7a5528bb27e37efea791cdb1fc40e17458b228.exe
"C:\Users\Admin\AppData\Local\Temp\4d9eb93c585d060718901a1aec7a5528bb27e37efea791cdb1fc40e17458b228.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 180
2⤵
- Program crash
PID:1476

memory/1476-56-0x0000000000000000-mapping.dmp

Download
memory/1480-54-0x0000000076581000-0x0000000076583000-memory.dmp

Filesize
8KB

Download
memory/1480-55-0x0000000000ED0000-0x0000000000F30000-memory.dmp

Filesize
384KB

Download