4452b0b5eee281b5a7e1f9b27538798bb78de07ebfdeb16a84dcfd4033a213d5

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/01/2023, 08:39

Target

4452b0b5eee281b5a7e1f9b27538798bb78de07ebfdeb16a84dcfd4033a213d5.exe
Size

1.0MB
MD5

70de5f770fa3084a7ab6b8fea3b1578b
SHA1

f1e0395cd5a642216123838aaad9db8ea01f014b
SHA256

4452b0b5eee281b5a7e1f9b27538798bb78de07ebfdeb16a84dcfd4033a213d5
SHA512

22a0fb77eaa8e016b7a21fe0496e4c0b0bc308e139b9b900a199efd68ebac5ec33fa1b969b62564db7f1511329e63f8565e3f66eaf6036290297ba097d66132b
SSDEEP

12288:HZ+2iN1/Sr+pVH8c+9eEtXU1XdsavwPvjWFdrzveQRu3cO8zUoaFaWFf+mDXttaU:M1e+VH80ExETwH+C2uMc5B

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
316	532	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 316	532	4452b0b5eee281b5a7e1f9b27538798bb78de07ebfdeb16a84dcfd4033a213d5.exe	28
PID 532 wrote to memory of 316	532	4452b0b5eee281b5a7e1f9b27538798bb78de07ebfdeb16a84dcfd4033a213d5.exe	28
PID 532 wrote to memory of 316	532	4452b0b5eee281b5a7e1f9b27538798bb78de07ebfdeb16a84dcfd4033a213d5.exe	28
PID 532 wrote to memory of 316	532	4452b0b5eee281b5a7e1f9b27538798bb78de07ebfdeb16a84dcfd4033a213d5.exe	28

C:\Users\Admin\AppData\Local\Temp\4452b0b5eee281b5a7e1f9b27538798bb78de07ebfdeb16a84dcfd4033a213d5.exe
"C:\Users\Admin\AppData\Local\Temp\4452b0b5eee281b5a7e1f9b27538798bb78de07ebfdeb16a84dcfd4033a213d5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 532 -s 628
  2⤵
  - Program crash
  PID:316

memory/532-54-0x0000000000CA0000-0x0000000000DA8000-memory.dmp

Filesize
1.0MB

Download
memory/532-55-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

Filesize
8KB

Download