4b36db346e4a319cb92698e04b59a8b73e7d3a3e7fe97d7d4ff58a7206e7e1f0

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 22:29

Target

4b36db346e4a319cb92698e04b59a8b73e7d3a3e7fe97d7d4ff58a7206e7e1f0.exe
Size

91KB
MD5

5299e54dfd63af26f51ed0a6dd430e5f
SHA1

81415d3ff0fcc89b17b7d4277f29db4bb6f15bde
SHA256

4b36db346e4a319cb92698e04b59a8b73e7d3a3e7fe97d7d4ff58a7206e7e1f0
SHA512

a9fa0987f8da85ed0341892b3c1ce6c1b54ace87989e3be2d49cbce9a040266bcf939e17c0fa9bb15eb902e4169d0d6a037c3d5d200533193d0a31a448443110
SSDEEP

1536:C3LLL6hoqpZqf9xMQLbjPSCufFJimnjG7mfTakDH/PiIHJFVG5aQ:F/W9yQmDNjffTakTjFe

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
840	1000	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 840	1000	4b36db346e4a319cb92698e04b59a8b73e7d3a3e7fe97d7d4ff58a7206e7e1f0.exe	27
PID 1000 wrote to memory of 840	1000	4b36db346e4a319cb92698e04b59a8b73e7d3a3e7fe97d7d4ff58a7206e7e1f0.exe	27
PID 1000 wrote to memory of 840	1000	4b36db346e4a319cb92698e04b59a8b73e7d3a3e7fe97d7d4ff58a7206e7e1f0.exe	27
PID 1000 wrote to memory of 840	1000	4b36db346e4a319cb92698e04b59a8b73e7d3a3e7fe97d7d4ff58a7206e7e1f0.exe	27

C:\Users\Admin\AppData\Local\Temp\4b36db346e4a319cb92698e04b59a8b73e7d3a3e7fe97d7d4ff58a7206e7e1f0.exe
"C:\Users\Admin\AppData\Local\Temp\4b36db346e4a319cb92698e04b59a8b73e7d3a3e7fe97d7d4ff58a7206e7e1f0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 36
  2⤵
  - Program crash
  PID:840

memory/1000-55-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download