4fa25c048fef1a745a088419fcd85fd8b1cfb2bbaca0988a2db71a886e6818d1

Analysis

max time kernel
140s
max time network
34s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
21-06-2023 22:03

Target

4fa25c048fef1a745a088419fcd85fd8b1cfb2bbaca0988a2db71a886e6818d1.exe
Size

516KB
MD5

dec86efe685b53031ac107b58c0f61f1
SHA1

3ecefd73d7e494b1c3cae681252d1c50fae303ed
SHA256

4fa25c048fef1a745a088419fcd85fd8b1cfb2bbaca0988a2db71a886e6818d1
SHA512

0e63b5ea25734b44e9a454c9b5a398b033a97346bc7c116155b882a374e45967f30bd722ab2a60d717b01247a7893ad1a76c21c1c81946ce1b6d1cce8ee04fda
SSDEEP

12288:55fOF0RT8jbq0bULO2sOQVElQkfjuUUadSsPHBx65wxTZv:i0Rgn4LDrj7dSr5wx1

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

928 1092 WerFault.exe 4fa25c048fef1a745a088419fcd85fd8b1cfb2bbaca0988a2db71a886e6818d1.exe

pid	pid_target	process	target process
928	1092	WerFault.exe	4fa25c048fef1a745a088419fcd85fd8b1cfb2bbaca0988a2db71a886e6818d1.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4fa25c048fef1a745a088419fcd85fd8b1cfb2bbaca0988a2db71a886e6818d1.exe

description	pid	process	target process
PID 1092 wrote to memory of 928	1092	4fa25c048fef1a745a088419fcd85fd8b1cfb2bbaca0988a2db71a886e6818d1.exe	WerFault.exe
PID 1092 wrote to memory of 928	1092	4fa25c048fef1a745a088419fcd85fd8b1cfb2bbaca0988a2db71a886e6818d1.exe	WerFault.exe
PID 1092 wrote to memory of 928	1092	4fa25c048fef1a745a088419fcd85fd8b1cfb2bbaca0988a2db71a886e6818d1.exe	WerFault.exe
PID 1092 wrote to memory of 928	1092	4fa25c048fef1a745a088419fcd85fd8b1cfb2bbaca0988a2db71a886e6818d1.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4fa25c048fef1a745a088419fcd85fd8b1cfb2bbaca0988a2db71a886e6818d1.exe
"C:\Users\Admin\AppData\Local\Temp\4fa25c048fef1a745a088419fcd85fd8b1cfb2bbaca0988a2db71a886e6818d1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 168
2⤵
- Program crash
PID:928

memory/1092-54-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download