a4c4e893a9223f92127cece370792cf9b9e5bb8f1772489097f76108f68e149b

Analysis

max time kernel
25s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 20:45

Target

a4c4e893a9223f92127cece370792cf9b9e5bb8f1772489097f76108f68e149b.exe
Size

23KB
MD5

a077ac942435d0cdd5a2382faff6204d
SHA1

54dbbcbd4909e78f167a26823ba2567f5f4972a1
SHA256

a4c4e893a9223f92127cece370792cf9b9e5bb8f1772489097f76108f68e149b
SHA512

6db9d056ce3601b791ad2f4117562556a86de9b5a96fb54d60a28eb705132f0a163b8aeaed713896db768cc85f1a006e9074567c678108435dd0ca570f498b5a
SSDEEP

384:tthIzxubyXvdy8xifCg2xdpmNUfCjE20CJHad3v0Jd9ao8mXBa2Fmu5nyKV:tHReXvU8xP0efkE2vJtdB18GmQyKV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1172	1224	WerFault.exe	22

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 1172	1224	a4c4e893a9223f92127cece370792cf9b9e5bb8f1772489097f76108f68e149b.exe	28
PID 1224 wrote to memory of 1172	1224	a4c4e893a9223f92127cece370792cf9b9e5bb8f1772489097f76108f68e149b.exe	28
PID 1224 wrote to memory of 1172	1224	a4c4e893a9223f92127cece370792cf9b9e5bb8f1772489097f76108f68e149b.exe	28
PID 1224 wrote to memory of 1172	1224	a4c4e893a9223f92127cece370792cf9b9e5bb8f1772489097f76108f68e149b.exe	28

C:\Users\Admin\AppData\Local\Temp\a4c4e893a9223f92127cece370792cf9b9e5bb8f1772489097f76108f68e149b.exe
"C:\Users\Admin\AppData\Local\Temp\a4c4e893a9223f92127cece370792cf9b9e5bb8f1772489097f76108f68e149b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 124
  2⤵
  - Program crash
  PID:1172