4a5a1059ac4868847b1c770c08d166a1cefa68168af566c2280fbccd0773934e

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
31-05-2024 07:42

Target

4a5a1059ac4868847b1c770c08d166a1cefa68168af566c2280fbccd0773934e.exe
Size

473KB
MD5

646842512919c08c056bd8faff7824b3
SHA1

62bc3bbaa209a0df9865cc1e937f18079276b183
SHA256

4a5a1059ac4868847b1c770c08d166a1cefa68168af566c2280fbccd0773934e
SHA512

969c845357eca26673a4911cfde8adec316cf7218a9a9c2c153c1fe543fcb9fe0a80ed5c3306b8086cb290bc198e4945d731678a48179c92cf3c713a7909779a
SSDEEP

6144:ADRIM+SzQZIrIe58wcjn8pu0/+s3zR7NdoM2iHZ4s5E+uRX3UlQ59yMdOhHSsgPH:pdI58wu8IT+RJdvBKsHudUlsExSsg3Y4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2600	2416	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2600	2416	4a5a1059ac4868847b1c770c08d166a1cefa68168af566c2280fbccd0773934e.exe	28
PID 2416 wrote to memory of 2600	2416	4a5a1059ac4868847b1c770c08d166a1cefa68168af566c2280fbccd0773934e.exe	28
PID 2416 wrote to memory of 2600	2416	4a5a1059ac4868847b1c770c08d166a1cefa68168af566c2280fbccd0773934e.exe	28
PID 2416 wrote to memory of 2600	2416	4a5a1059ac4868847b1c770c08d166a1cefa68168af566c2280fbccd0773934e.exe	28

C:\Users\Admin\AppData\Local\Temp\4a5a1059ac4868847b1c770c08d166a1cefa68168af566c2280fbccd0773934e.exe
"C:\Users\Admin\AppData\Local\Temp\4a5a1059ac4868847b1c770c08d166a1cefa68168af566c2280fbccd0773934e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 212
  2⤵
  - Program crash
  PID:2600

memory/2416-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2416-1-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2416-8-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/2416-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2416-6-0x0000000000401000-0x0000000000429000-memory.dmp

Filesize
160KB

Download
memory/2416-5-0x0000000000230000-0x000000000026D000-memory.dmp

Filesize
244KB

Download
memory/2416-4-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2416-3-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2416-2-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2416-9-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2416-12-0x0000000000230000-0x000000000026D000-memory.dmp

Filesize
244KB

Download
memory/2416-13-0x0000000000401000-0x0000000000429000-memory.dmp

Filesize
160KB

Download