f45244586bbb5142b7da19496e2f8d346ddff29619fa5425f91852eb2a707a2d

Analysis

max time kernel
12s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 13:38

Target

f45244586bbb5142b7da19496e2f8d346ddff29619fa5425f91852eb2a707a2d.exe
Size

51KB
MD5

530317fa62d79d6746a902dbe5eb489c
SHA1

5d02cc333759baacbaf9f09cb71083810d723afc
SHA256

f45244586bbb5142b7da19496e2f8d346ddff29619fa5425f91852eb2a707a2d
SHA512

3f9ab9f47949e946a342a52fb40f7f557725e9add0f70bc6bfaa18261c176c3f6eab253c143d748c352ed49592e98d8ad7409a3d9e4293e11d03f32ca44cd6f0
SSDEEP

384:Tg3hiOVVGFYgUEP53TqxCdiN+a1R3zCoL8+uiH9rS6ZbM/wrq/z5S+WBcIx+HhbD:03ZV0SgPBTlcR3z45CIB3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1484	948	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 1484	948	f45244586bbb5142b7da19496e2f8d346ddff29619fa5425f91852eb2a707a2d.exe	28
PID 948 wrote to memory of 1484	948	f45244586bbb5142b7da19496e2f8d346ddff29619fa5425f91852eb2a707a2d.exe	28
PID 948 wrote to memory of 1484	948	f45244586bbb5142b7da19496e2f8d346ddff29619fa5425f91852eb2a707a2d.exe	28
PID 948 wrote to memory of 1484	948	f45244586bbb5142b7da19496e2f8d346ddff29619fa5425f91852eb2a707a2d.exe	28

C:\Users\Admin\AppData\Local\Temp\f45244586bbb5142b7da19496e2f8d346ddff29619fa5425f91852eb2a707a2d.exe
"C:\Users\Admin\AppData\Local\Temp\f45244586bbb5142b7da19496e2f8d346ddff29619fa5425f91852eb2a707a2d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 148
  2⤵
  - Program crash
  PID:1484

memory/948-54-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download