b4a5f19cd43de4b5a8e6ce8c5a4106af01f8f9c2134ad2bbc7c3bffb36205f8b

Analysis

max time kernel
41s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 19:48

Target

b4a5f19cd43de4b5a8e6ce8c5a4106af01f8f9c2134ad2bbc7c3bffb36205f8b.exe
Size

148KB
MD5

bb26fcc89bf647ee8c519ff453815392
SHA1

f718ee3f6dd88730a7a34477d6832f48f762e242
SHA256

b4a5f19cd43de4b5a8e6ce8c5a4106af01f8f9c2134ad2bbc7c3bffb36205f8b
SHA512

6633578d5b5d0d6768f4ef7fb4a8c7aa13a8a7314d6d348f4dee414b43b03ce7dbb945af2158aa6c6c4c31fed82930205551cde81a9f88476f7867b14b53c8d2
SSDEEP

3072:o4Yd+dVa3UI8bYqXjRPKthonA2rY4Rj8G5Poh:V4EgKMaj4hor8Gg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1552	1312	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 1552	1312	b4a5f19cd43de4b5a8e6ce8c5a4106af01f8f9c2134ad2bbc7c3bffb36205f8b.exe	29
PID 1312 wrote to memory of 1552	1312	b4a5f19cd43de4b5a8e6ce8c5a4106af01f8f9c2134ad2bbc7c3bffb36205f8b.exe	29
PID 1312 wrote to memory of 1552	1312	b4a5f19cd43de4b5a8e6ce8c5a4106af01f8f9c2134ad2bbc7c3bffb36205f8b.exe	29
PID 1312 wrote to memory of 1552	1312	b4a5f19cd43de4b5a8e6ce8c5a4106af01f8f9c2134ad2bbc7c3bffb36205f8b.exe	29

C:\Users\Admin\AppData\Local\Temp\b4a5f19cd43de4b5a8e6ce8c5a4106af01f8f9c2134ad2bbc7c3bffb36205f8b.exe
"C:\Users\Admin\AppData\Local\Temp\b4a5f19cd43de4b5a8e6ce8c5a4106af01f8f9c2134ad2bbc7c3bffb36205f8b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1312 -s 96
  2⤵
  - Program crash
  PID:1552