4f793f66e760cd93bcd504135387a7c674638c70a214e0ff05a71e9d4f412a5a

Analysis

max time kernel
36s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 12:43

Target

4f793f66e760cd93bcd504135387a7c674638c70a214e0ff05a71e9d4f412a5a.exe
Size

402KB
MD5

ea85b1d03941af66f33b14f72296f71f
SHA1

3c326d4fd0f69178bce983baf49551eada1eda4e
SHA256

4f793f66e760cd93bcd504135387a7c674638c70a214e0ff05a71e9d4f412a5a
SHA512

299ce28f9de06efdc5b2dcaa4b2ba31fa7bf3ca6a68d2304a7962953a70046543993714bec8f35eac9541fed2179a053d5a88bcae692745a26c8a6b494d49213
SSDEEP

6144:VpteKpbNZm7e+JPP+xCKVBzakE7G/XAxb5vSr31RYDrLhCuS:gKU7dX+xJVBz+1xbh831RYDrLS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1972	1992	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1972	1992	4f793f66e760cd93bcd504135387a7c674638c70a214e0ff05a71e9d4f412a5a.exe	26
PID 1992 wrote to memory of 1972	1992	4f793f66e760cd93bcd504135387a7c674638c70a214e0ff05a71e9d4f412a5a.exe	26
PID 1992 wrote to memory of 1972	1992	4f793f66e760cd93bcd504135387a7c674638c70a214e0ff05a71e9d4f412a5a.exe	26
PID 1992 wrote to memory of 1972	1992	4f793f66e760cd93bcd504135387a7c674638c70a214e0ff05a71e9d4f412a5a.exe	26

C:\Users\Admin\AppData\Local\Temp\4f793f66e760cd93bcd504135387a7c674638c70a214e0ff05a71e9d4f412a5a.exe
"C:\Users\Admin\AppData\Local\Temp\4f793f66e760cd93bcd504135387a7c674638c70a214e0ff05a71e9d4f412a5a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 196
  2⤵
  - Program crash
  PID:1972

memory/1992-54-0x0000000076141000-0x0000000076143000-memory.dmp

Filesize
8KB

Download
memory/1992-55-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1992-57-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download