4cfda9d35ca2225fd985f2e7bbdb91e4539ca74d0a51aaaf427470a5810a0da1

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
15/08/2023, 09:10

Target

4cfda9d35ca2225fd985f2e7bbdb91e4539ca74d0a51aaaf427470a5810a0da1.exe
Size

3.7MB
MD5

22a36963ec987bbd308e0e9af86e4c6a
SHA1

fda790b13db4e642cf2a322f171db86f4434a8b2
SHA256

4cfda9d35ca2225fd985f2e7bbdb91e4539ca74d0a51aaaf427470a5810a0da1
SHA512

b2f5b6a6ce4523fccd600956df6e56decac322f4f88a50860a469d559f55648db974d2fb6901dd6b7dcd3122fd22a54dd09d71a45cd5537a46c845051ca1f3b7
SSDEEP

24576:NWCQUbWCB+fZj/r91B4V9zZ14BORr4xkFHr2bFJTN0wQunQB:NyJZj/r9eZBr4yWRQB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1688	1040	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 1688	1040	4cfda9d35ca2225fd985f2e7bbdb91e4539ca74d0a51aaaf427470a5810a0da1.exe	28
PID 1040 wrote to memory of 1688	1040	4cfda9d35ca2225fd985f2e7bbdb91e4539ca74d0a51aaaf427470a5810a0da1.exe	28
PID 1040 wrote to memory of 1688	1040	4cfda9d35ca2225fd985f2e7bbdb91e4539ca74d0a51aaaf427470a5810a0da1.exe	28
PID 1040 wrote to memory of 1688	1040	4cfda9d35ca2225fd985f2e7bbdb91e4539ca74d0a51aaaf427470a5810a0da1.exe	28

C:\Users\Admin\AppData\Local\Temp\4cfda9d35ca2225fd985f2e7bbdb91e4539ca74d0a51aaaf427470a5810a0da1.exe
"C:\Users\Admin\AppData\Local\Temp\4cfda9d35ca2225fd985f2e7bbdb91e4539ca74d0a51aaaf427470a5810a0da1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 36
  2⤵
  - Program crash
  PID:1688

memory/1040-54-0x0000000000400000-0x0000000001CF6000-memory.dmp

Filesize
25.0MB

Download