f35385a0d3cb6488819b0e2c14ed6d97de7f01bbdb08c8fb198218837883b734

Analysis

Target
HEy0BaVJ6WUy6aM.exe
Size 493KB
Sample220511-tvsf5sffcj
SHA256 f35385a0d3cb6488819b0e2c14ed6d97de7f01bbdb08c8fb198218837883b734
MD5 257eab0847319dafe9522c7b4a6a8e67
SHA1 bf2c144513911fd1962ed8493294e7ed19586d23
SHA512 14fdbf17b3a21f17a13f8d37b9cd7b72e3764aeb3b23ccda8b4871201b86a746139d1e8755276b19fe7e63b569179f06367205d8d6196ef2f8e3883faece41d8
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1420	992	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 1420	992	HEy0BaVJ6WUy6aM.exe	27
PID 992 wrote to memory of 1420	992	HEy0BaVJ6WUy6aM.exe	27
PID 992 wrote to memory of 1420	992	HEy0BaVJ6WUy6aM.exe	27
PID 992 wrote to memory of 1420	992	HEy0BaVJ6WUy6aM.exe	27

C:\Users\Admin\AppData\Local\Temp\HEy0BaVJ6WUy6aM.exe
"C:\Users\Admin\AppData\Local\Temp\HEy0BaVJ6WUy6aM.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 708
  2⤵
  - Program crash
  PID:1420

memory/992-54-0x0000000000F40000-0x0000000000FC2000-memory.dmp

Download

memory/992-55-0x0000000076181000-0x0000000076183000-memory.dmp

Download

memory/992-56-0x00000000004A0000-0x00000000004A8000-memory.dmp

Download