460aac691292c7edea113f6e9b4adc5e30d87c8d7f7fa499c02f5a585498954a

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07/10/2023, 11:04

Target

460aac691292c7edea113f6e9b4adc5e30d87c8d7f7fa499c02f5a585498954a.exe
Size

152KB
MD5

1a7b1b8bfd8b4ae411f5dbd7749f32a6
SHA1

926aee7ee3d59cd7307af66d0e68cac1f5d6a5c1
SHA256

460aac691292c7edea113f6e9b4adc5e30d87c8d7f7fa499c02f5a585498954a
SHA512

d1d3d7c37b8a9caa1113ca6c088382e8c3f0f958fdf6ea974811273fe01233c98d6c4a0cc8b8fec245d1a4801044e061df9ba4b3b14b53330181aec739b9178d
SSDEEP

3072:8jyZOELfgXi7lGUIA8Ap6SJxyvEPYZOwQSnEVR4l1WGzz:RZ56WxKDZdHngGH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2584	1956	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2584	1956	460aac691292c7edea113f6e9b4adc5e30d87c8d7f7fa499c02f5a585498954a.exe	28
PID 1956 wrote to memory of 2584	1956	460aac691292c7edea113f6e9b4adc5e30d87c8d7f7fa499c02f5a585498954a.exe	28
PID 1956 wrote to memory of 2584	1956	460aac691292c7edea113f6e9b4adc5e30d87c8d7f7fa499c02f5a585498954a.exe	28
PID 1956 wrote to memory of 2584	1956	460aac691292c7edea113f6e9b4adc5e30d87c8d7f7fa499c02f5a585498954a.exe	28

C:\Users\Admin\AppData\Local\Temp\460aac691292c7edea113f6e9b4adc5e30d87c8d7f7fa499c02f5a585498954a.exe
"C:\Users\Admin\AppData\Local\Temp\460aac691292c7edea113f6e9b4adc5e30d87c8d7f7fa499c02f5a585498954a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 184
  2⤵
  - Program crash
  PID:2584