4f21ab1bbd4adadfa0bb34b4cf4e4ba197b65cc372f4f9b8d6a0a58a506598eb

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
19/11/2023, 08:59

Target

4f21ab1bbd4adadfa0bb34b4cf4e4ba197b65cc372f4f9b8d6a0a58a506598eb.exe
Size

14.5MB
MD5

7aaf181666b84d6ffabe37ba44a65701
SHA1

a0e4837115d30e312f376b2c343971ee6d0056f2
SHA256

4f21ab1bbd4adadfa0bb34b4cf4e4ba197b65cc372f4f9b8d6a0a58a506598eb
SHA512

4b897b827ae2bae6bc199ff129d02e5c27183d14b5f35bf6aabd1921ea242059035e2dc83029bcc8016a7b289dc53a97c21b9792bc5defd3cfc98b39e9d983dd
SSDEEP

393216:A+tpUyKfGSJKhKkbfxRsn57My9BK5cu+0nnOQJ+jF:A+My6TJVkDDsn5je5XJOQUx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2716	3048	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2716	3048	4f21ab1bbd4adadfa0bb34b4cf4e4ba197b65cc372f4f9b8d6a0a58a506598eb.exe	27
PID 3048 wrote to memory of 2716	3048	4f21ab1bbd4adadfa0bb34b4cf4e4ba197b65cc372f4f9b8d6a0a58a506598eb.exe	27
PID 3048 wrote to memory of 2716	3048	4f21ab1bbd4adadfa0bb34b4cf4e4ba197b65cc372f4f9b8d6a0a58a506598eb.exe	27
PID 3048 wrote to memory of 2716	3048	4f21ab1bbd4adadfa0bb34b4cf4e4ba197b65cc372f4f9b8d6a0a58a506598eb.exe	27

C:\Users\Admin\AppData\Local\Temp\4f21ab1bbd4adadfa0bb34b4cf4e4ba197b65cc372f4f9b8d6a0a58a506598eb.exe
"C:\Users\Admin\AppData\Local\Temp\4f21ab1bbd4adadfa0bb34b4cf4e4ba197b65cc372f4f9b8d6a0a58a506598eb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 304
  2⤵
  - Program crash
  PID:2716

memory/3048-0-0x0000000000400000-0x0000000001AA5000-memory.dmp

Filesize
22.6MB

Download
memory/3048-2-0x0000000004D80000-0x0000000005142000-memory.dmp

Filesize
3.8MB

Download
memory/3048-4-0x0000000004D80000-0x0000000005142000-memory.dmp

Filesize
3.8MB

Download
memory/3048-7-0x0000000004D80000-0x0000000005142000-memory.dmp

Filesize
3.8MB

Download
memory/3048-11-0x0000000004D80000-0x0000000005142000-memory.dmp

Filesize
3.8MB

Download
memory/3048-15-0x0000000004D80000-0x0000000005142000-memory.dmp

Filesize
3.8MB

Download
memory/3048-19-0x0000000004D80000-0x0000000005142000-memory.dmp

Filesize
3.8MB

Download
memory/3048-23-0x0000000004D80000-0x0000000005142000-memory.dmp

Filesize
3.8MB

Download
memory/3048-26-0x0000000004D80000-0x0000000005142000-memory.dmp

Filesize
3.8MB

Download
memory/3048-27-0x0000000004D80000-0x0000000005142000-memory.dmp

Filesize
3.8MB

Download
memory/3048-28-0x0000000004D80000-0x0000000005142000-memory.dmp

Filesize
3.8MB

Download
memory/3048-29-0x0000000000400000-0x0000000001AA5000-memory.dmp

Filesize
22.6MB

Download