4cb91df3f13ff362903e62687ef6bca610a251f6bae5df8cae57fba317e0b40a

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
31-03-2023 19:37

Target

4cb91df3f13ff362903e62687ef6bca610a251f6bae5df8cae57fba317e0b40a.exe
Size

560KB
MD5

f0548aa5a3a80325538f852f127de672
SHA1

2b426978e0810ec2d23b23255d731bb9541dedf1
SHA256

4cb91df3f13ff362903e62687ef6bca610a251f6bae5df8cae57fba317e0b40a
SHA512

7c8175e6c7def9ae8cc2d8c33275e3107351b4a211424402d0d3b4b53cfe2eb1a2c5f4f4e3562b8bd5ce9b042295b9e84f193e3aff7549e8ce60466ea653507e
SSDEEP

12288:EqZw6HBtzJj09unpfPJiUqc037/guyJcFi7gjiRpEj554xC6k7:8mzcsPJxqd37/DyJqiKPOC6k7

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1952 2008 WerFault.exe 4cb91df3f13ff362903e62687ef6bca610a251f6bae5df8cae57fba317e0b40a.exe

pid	pid_target	process	target process
1952	2008	WerFault.exe	4cb91df3f13ff362903e62687ef6bca610a251f6bae5df8cae57fba317e0b40a.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4cb91df3f13ff362903e62687ef6bca610a251f6bae5df8cae57fba317e0b40a.exe

description	pid	process	target process
PID 2008 wrote to memory of 1952	2008	4cb91df3f13ff362903e62687ef6bca610a251f6bae5df8cae57fba317e0b40a.exe	WerFault.exe
PID 2008 wrote to memory of 1952	2008	4cb91df3f13ff362903e62687ef6bca610a251f6bae5df8cae57fba317e0b40a.exe	WerFault.exe
PID 2008 wrote to memory of 1952	2008	4cb91df3f13ff362903e62687ef6bca610a251f6bae5df8cae57fba317e0b40a.exe	WerFault.exe
PID 2008 wrote to memory of 1952	2008	4cb91df3f13ff362903e62687ef6bca610a251f6bae5df8cae57fba317e0b40a.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4cb91df3f13ff362903e62687ef6bca610a251f6bae5df8cae57fba317e0b40a.exe
"C:\Users\Admin\AppData\Local\Temp\4cb91df3f13ff362903e62687ef6bca610a251f6bae5df8cae57fba317e0b40a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 584
2⤵
- Program crash
PID:1952

memory/2008-54-0x00000000008C0000-0x0000000000952000-memory.dmp

Filesize
584KB

Download
memory/2008-55-0x0000000006ED0000-0x0000000006F78000-memory.dmp

Filesize
672KB

Download
memory/2008-56-0x0000000004840000-0x0000000004880000-memory.dmp

Filesize
256KB

Download
memory/2008-57-0x0000000004840000-0x0000000004880000-memory.dmp

Filesize
256KB

Download