5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc

Analysis

max time kernel
150s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20220722-en
resource tags

arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system
submitted
31-07-2022 12:14

Target

5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc.exe
Size

342KB
MD5

1363011ce43fdadbff9360a2e2716731
SHA1

d980ddf282aa7170c38caaa4fe73d05cf04d9fe6
SHA256

5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc
SHA512

355c654a7226f6c68367f0ede1f294d84f5f2d8b70757c9c0b20546589971b5534d67b0a99360acca7d5a0251aca0339b55226e859d5d53637a5491533072feb

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
2236	5100	WerFault.exe	5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc.exe
4968	5100	WerFault.exe	5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc.exe

description	pid	process	target process
PID 5100 wrote to memory of 2236	5100	5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc.exe	WerFault.exe
PID 5100 wrote to memory of 2236	5100	5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc.exe	WerFault.exe
PID 5100 wrote to memory of 2236	5100	5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc.exe
"C:\Users\Admin\AppData\Local\Temp\5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5100 -s 524
  2⤵
  - Program crash
  PID:2236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5100 -s 524
  2⤵
  - Program crash
  PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5100 -ip 5100
1⤵
PID:2772

memory/2236-133-0x0000000000000000-mapping.dmp

Download
memory/5100-132-0x0000000002290000-0x00000000022BE000-memory.dmp

Filesize
184KB

Download