054a49848ede89812d5458c278b4ab607075a717dbc8be35213221a205af800e

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:02

Target

054a49848ede89812d5458c278b4ab607075a717dbc8be35213221a205af800e.exe
Size

812KB
MD5

1476e0d3cde15b9940efe0cf84746f6f
SHA1

529e37d3e2138456725b70a20120de2bbc1582a1
SHA256

054a49848ede89812d5458c278b4ab607075a717dbc8be35213221a205af800e
SHA512

ca6e6e6dd12cf31ac27c6be52ca3244a3c151f18d5317cf941422e00a78ff3013c07ed14d8076301e167735eaec743d9433692e285d0a7554d8b09577abb7786
SSDEEP

6144:Sm57PZMTySqZf9akvh+e7VOhHE1L8ohQROlIoHqDqLXXV2OF2Hds+dvHq32g:S27ZMTyLf8Mh+e7VOtEMsJqDqLT

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1128 2884 WerFault.exe 054a49848ede89812d5458c278b4ab607075a717dbc8be35213221a205af800e.exe

pid	pid_target	process	target process
1128	2884	WerFault.exe	054a49848ede89812d5458c278b4ab607075a717dbc8be35213221a205af800e.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

054a49848ede89812d5458c278b4ab607075a717dbc8be35213221a205af800e.exe

description	pid	process	target process
PID 2884 wrote to memory of 1128	2884	054a49848ede89812d5458c278b4ab607075a717dbc8be35213221a205af800e.exe	WerFault.exe
PID 2884 wrote to memory of 1128	2884	054a49848ede89812d5458c278b4ab607075a717dbc8be35213221a205af800e.exe	WerFault.exe
PID 2884 wrote to memory of 1128	2884	054a49848ede89812d5458c278b4ab607075a717dbc8be35213221a205af800e.exe	WerFault.exe
PID 2884 wrote to memory of 1128	2884	054a49848ede89812d5458c278b4ab607075a717dbc8be35213221a205af800e.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\054a49848ede89812d5458c278b4ab607075a717dbc8be35213221a205af800e.exe
"C:\Users\Admin\AppData\Local\Temp\054a49848ede89812d5458c278b4ab607075a717dbc8be35213221a205af800e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 36
2⤵
- Program crash
PID:1128