d4321e70a1ab529faf9a413094a1f74a4094757fa8db8f0f04481f678390fc40

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
29/05/2023, 11:21

Target

d4321e70a1ab529faf9a413094a1f74a4094757fa8db8f0f04481f678390fc40.exe
Size

695KB
MD5

ade8d105ec64c626163e2370fa226ac1
SHA1

28e374b93ea1955502ccb0d1f6bef41537d38f6f
SHA256

d4321e70a1ab529faf9a413094a1f74a4094757fa8db8f0f04481f678390fc40
SHA512

c851db11039891013dc92d036b4e4fd6b2a643331c05848ce8c6020545bdfd9481f3af75d37796d9b86565be574f4190d32380a7db0ad7778c7b22bf36c775aa
SSDEEP

12288:5FszBhiS5my6JL29I0mzpZm9tCzlN3yBXscC2RO1aSUG/dq3n0/aIPQhkLT+CtUy:5FszeS5CE9mzpaCxN3EXsdPs1Y0rIPQ0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1300	1076	WerFault.exe	26

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 1300	1076	d4321e70a1ab529faf9a413094a1f74a4094757fa8db8f0f04481f678390fc40.exe	27
PID 1076 wrote to memory of 1300	1076	d4321e70a1ab529faf9a413094a1f74a4094757fa8db8f0f04481f678390fc40.exe	27
PID 1076 wrote to memory of 1300	1076	d4321e70a1ab529faf9a413094a1f74a4094757fa8db8f0f04481f678390fc40.exe	27
PID 1076 wrote to memory of 1300	1076	d4321e70a1ab529faf9a413094a1f74a4094757fa8db8f0f04481f678390fc40.exe	27
PID 1076 wrote to memory of 1300	1076	d4321e70a1ab529faf9a413094a1f74a4094757fa8db8f0f04481f678390fc40.exe	27
PID 1076 wrote to memory of 1300	1076	d4321e70a1ab529faf9a413094a1f74a4094757fa8db8f0f04481f678390fc40.exe	27
PID 1076 wrote to memory of 1300	1076	d4321e70a1ab529faf9a413094a1f74a4094757fa8db8f0f04481f678390fc40.exe	27

C:\Users\Admin\AppData\Local\Temp\d4321e70a1ab529faf9a413094a1f74a4094757fa8db8f0f04481f678390fc40.exe
"C:\Users\Admin\AppData\Local\Temp\d4321e70a1ab529faf9a413094a1f74a4094757fa8db8f0f04481f678390fc40.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 364
  2⤵
  - Program crash
  PID:1300