459af92a49740f28eea8495ea6178fbd52ed1ff7ba4ee2eb8aa73ff1b9f373ca

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
06/10/2023, 05:51

Target

459af92a49740f28eea8495ea6178fbd52ed1ff7ba4ee2eb8aa73ff1b9f373ca.exe
Size

5KB
MD5

ab64014459b1a351a30566871c959619
SHA1

4786e1f5d163aedb126740aa6ce2fa13cc7cc80a
SHA256

459af92a49740f28eea8495ea6178fbd52ed1ff7ba4ee2eb8aa73ff1b9f373ca
SHA512

0a98e03b121369827d2bf8dc2c7f559f59e5d7bc54ecc31f49547bf4cb95406939c7264989b56b6b7dc0c0cc5da898d6483b2cabb825e45803628aa5c4830793
SSDEEP

48:S5lXWFPpT+dXVfzZh4yMGcKzMEkTaak4PAZivO2pB42pBdvMZL2R7tkRuqSxp:uWLkFfNnOKYloIQ2pm2pbYSgxE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1204	1260	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 1204	1260	459af92a49740f28eea8495ea6178fbd52ed1ff7ba4ee2eb8aa73ff1b9f373ca.exe	28
PID 1260 wrote to memory of 1204	1260	459af92a49740f28eea8495ea6178fbd52ed1ff7ba4ee2eb8aa73ff1b9f373ca.exe	28
PID 1260 wrote to memory of 1204	1260	459af92a49740f28eea8495ea6178fbd52ed1ff7ba4ee2eb8aa73ff1b9f373ca.exe	28
PID 1260 wrote to memory of 1204	1260	459af92a49740f28eea8495ea6178fbd52ed1ff7ba4ee2eb8aa73ff1b9f373ca.exe	28

C:\Users\Admin\AppData\Local\Temp\459af92a49740f28eea8495ea6178fbd52ed1ff7ba4ee2eb8aa73ff1b9f373ca.exe
"C:\Users\Admin\AppData\Local\Temp\459af92a49740f28eea8495ea6178fbd52ed1ff7ba4ee2eb8aa73ff1b9f373ca.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 48
  2⤵
  - Program crash
  PID:1204