546f5bb4208c4478f76f23174f23dcb23694552527c1b5211980a6402f7c1940

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
08/04/2024, 21:16

Target

546f5bb4208c4478f76f23174f23dcb23694552527c1b5211980a6402f7c1940.exe
Size

592KB
MD5

ccaadb373de8a2a0c0a3f29fe7fb13f2
SHA1

d1d061f25d25f038366c3f840e78e57a0dd55c66
SHA256

546f5bb4208c4478f76f23174f23dcb23694552527c1b5211980a6402f7c1940
SHA512

e5f106ef3248009da5134add55cfbcb9387196f475941b504af3096d90814341b4b48a5476d0b672463d80d182a4f3fb1e3a7b16954796316016d049caef0f22
SSDEEP

6144:wqDAwl0xPTMiR9JSSxPUKododHVwpnOSQ:w+67XR9JSSxvododHVwpOSQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2056	1992	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2056	1992	546f5bb4208c4478f76f23174f23dcb23694552527c1b5211980a6402f7c1940.exe	28
PID 1992 wrote to memory of 2056	1992	546f5bb4208c4478f76f23174f23dcb23694552527c1b5211980a6402f7c1940.exe	28
PID 1992 wrote to memory of 2056	1992	546f5bb4208c4478f76f23174f23dcb23694552527c1b5211980a6402f7c1940.exe	28
PID 1992 wrote to memory of 2056	1992	546f5bb4208c4478f76f23174f23dcb23694552527c1b5211980a6402f7c1940.exe	28

C:\Users\Admin\AppData\Local\Temp\546f5bb4208c4478f76f23174f23dcb23694552527c1b5211980a6402f7c1940.exe
"C:\Users\Admin\AppData\Local\Temp\546f5bb4208c4478f76f23174f23dcb23694552527c1b5211980a6402f7c1940.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 36
  2⤵
  - Program crash
  PID:2056