05454509b74e78dc5e4b9fc9a9f058c900fbcfd65c55ff4808ff7f0319ca747b

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 06:36

Target

05454509b74e78dc5e4b9fc9a9f058c900fbcfd65c55ff4808ff7f0319ca747b.exe
Size

56KB
MD5

9e9e80f66cc09a2d67d3f95c2dcdcf81
SHA1

7a31ad2f25cc3a036512b1c4dadde7a62728ac6a
SHA256

05454509b74e78dc5e4b9fc9a9f058c900fbcfd65c55ff4808ff7f0319ca747b
SHA512

0b4976c290c0eeaf004ee99a3000c543095aa3874d6d6e8903f8251baf27e5bc8205da5ff2798b6e4261f229cc22ef00b3e69ab537fa23e4ca739cf2a73cfb73
SSDEEP

1536:51vW5BjFeRMZyzM4rL5NOUqQ0pgQreyFml3R6/xQaRySKId91DACicy0Q7mbt2oV:Qdwnv/++/xPnkYuYW+Q

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
368	1684	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 368	1684	05454509b74e78dc5e4b9fc9a9f058c900fbcfd65c55ff4808ff7f0319ca747b.exe	27
PID 1684 wrote to memory of 368	1684	05454509b74e78dc5e4b9fc9a9f058c900fbcfd65c55ff4808ff7f0319ca747b.exe	27
PID 1684 wrote to memory of 368	1684	05454509b74e78dc5e4b9fc9a9f058c900fbcfd65c55ff4808ff7f0319ca747b.exe	27
PID 1684 wrote to memory of 368	1684	05454509b74e78dc5e4b9fc9a9f058c900fbcfd65c55ff4808ff7f0319ca747b.exe	27

C:\Users\Admin\AppData\Local\Temp\05454509b74e78dc5e4b9fc9a9f058c900fbcfd65c55ff4808ff7f0319ca747b.exe
"C:\Users\Admin\AppData\Local\Temp\05454509b74e78dc5e4b9fc9a9f058c900fbcfd65c55ff4808ff7f0319ca747b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 36
  2⤵
  - Program crash
  PID:368