4064359b83138024ea3df2897a2aeb964d64ee7bd05766c41aca8af4fa3c7684

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24/03/2023, 09:51

Target

4064359b83138024ea3df2897a2aeb964d64ee7bd05766c41aca8af4fa3c7684.exe
Size

732KB
MD5

cf1a4cb2ba775427fd7b561cf0b0e047
SHA1

d0f0a40ad99e7f3e94494b0629479056b5815d87
SHA256

4064359b83138024ea3df2897a2aeb964d64ee7bd05766c41aca8af4fa3c7684
SHA512

25c53c67d018232a2184910db5be2625b3bed17b3e8c964529d44b02183f8316188c55a9c0c828a1b364ad832154b8cc85fd626c32aaa68942f64e3513c92be6
SSDEEP

12288:gnOByNSugkV6VqrRr0GB/PMGBpjZBMoL7kZiL7k7V91vu:KrRr0GB3FptBMNZiLoZu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1400	1728	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1400	1728	4064359b83138024ea3df2897a2aeb964d64ee7bd05766c41aca8af4fa3c7684.exe	28
PID 1728 wrote to memory of 1400	1728	4064359b83138024ea3df2897a2aeb964d64ee7bd05766c41aca8af4fa3c7684.exe	28
PID 1728 wrote to memory of 1400	1728	4064359b83138024ea3df2897a2aeb964d64ee7bd05766c41aca8af4fa3c7684.exe	28
PID 1728 wrote to memory of 1400	1728	4064359b83138024ea3df2897a2aeb964d64ee7bd05766c41aca8af4fa3c7684.exe	28

C:\Users\Admin\AppData\Local\Temp\4064359b83138024ea3df2897a2aeb964d64ee7bd05766c41aca8af4fa3c7684.exe
"C:\Users\Admin\AppData\Local\Temp\4064359b83138024ea3df2897a2aeb964d64ee7bd05766c41aca8af4fa3c7684.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 152
  2⤵
  - Program crash
  PID:1400

memory/1728-54-0x0000000000180000-0x0000000000263000-memory.dmp

Filesize
908KB

Download