4cc68d236658dec85f486f17c27e7f09a71dfc2b2e8327639ec145c9c98d2be3

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
23/08/2023, 12:09

Target

4cc68d236658dec85f486f17c27e7f09a71dfc2b2e8327639ec145c9c98d2be3.exe
Size

1.1MB
MD5

59c849eddb96c7e585f6595c20ca790f
SHA1

942ddbee1690d49ba7fed3ca67f9189f294cdabf
SHA256

4cc68d236658dec85f486f17c27e7f09a71dfc2b2e8327639ec145c9c98d2be3
SHA512

6ffea545d1371493c1a75c31623e54449003eea659cf01863143b70732f6e7624e542fccc2c165191d7a6dd1be035f59f3ae951c42825d03504380b1a689014e
SSDEEP

12288:RnmXyUzxJFRWYZUgCQAUVsk+Eo4JRSNYD6I4YZCVQ5NAvBXla5k:RGVxs6GQjqt4vSnqX5NA1I5k

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2248	2152	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2248	2152	4cc68d236658dec85f486f17c27e7f09a71dfc2b2e8327639ec145c9c98d2be3.exe	28
PID 2152 wrote to memory of 2248	2152	4cc68d236658dec85f486f17c27e7f09a71dfc2b2e8327639ec145c9c98d2be3.exe	28
PID 2152 wrote to memory of 2248	2152	4cc68d236658dec85f486f17c27e7f09a71dfc2b2e8327639ec145c9c98d2be3.exe	28

C:\Users\Admin\AppData\Local\Temp\4cc68d236658dec85f486f17c27e7f09a71dfc2b2e8327639ec145c9c98d2be3.exe
"C:\Users\Admin\AppData\Local\Temp\4cc68d236658dec85f486f17c27e7f09a71dfc2b2e8327639ec145c9c98d2be3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2152 -s 528
  2⤵
  - Program crash
  PID:2248

memory/2152-0-0x00000000008B0000-0x00000000009CA000-memory.dmp

Filesize
1.1MB

Download
memory/2152-1-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp

Filesize
9.9MB

Download
memory/2152-2-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp

Filesize
9.9MB

Download