ba292c71636f627a58ffbd25a5fe289a87882864f5f01e3cc82c2e94e11c8f45

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
08/09/2022, 19:47

Target

5b68f7ba515e317a58bf07f37a2eef9d.exe
Size

186KB
MD5

5b68f7ba515e317a58bf07f37a2eef9d
SHA1

ec4ae9d0ec91e867c6dd7124591751314bafbe0e
SHA256

ba292c71636f627a58ffbd25a5fe289a87882864f5f01e3cc82c2e94e11c8f45
SHA512

5b4a82ae7bd6e63b581f6cfc296e65bc7651dea44e64b35328ddb2b24d8e0f2a8a4640bd8879607db1230efbbd3c7e8026e10c1b85cae3c0b881e54d8eb57078
SSDEEP

3072:Ou7sJwyOX9oC6UsHF20u5EQ1V279gh/BFku3duyhN8Oen16fJYVwEMvh:Om6UslAEcV279a/B/duyhS1nkCVwPvh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1124	1492	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1124	1492	5b68f7ba515e317a58bf07f37a2eef9d.exe	27
PID 1492 wrote to memory of 1124	1492	5b68f7ba515e317a58bf07f37a2eef9d.exe	27
PID 1492 wrote to memory of 1124	1492	5b68f7ba515e317a58bf07f37a2eef9d.exe	27
PID 1492 wrote to memory of 1124	1492	5b68f7ba515e317a58bf07f37a2eef9d.exe	27

C:\Users\Admin\AppData\Local\Temp\5b68f7ba515e317a58bf07f37a2eef9d.exe
"C:\Users\Admin\AppData\Local\Temp\5b68f7ba515e317a58bf07f37a2eef9d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 48
  2⤵
  - Program crash
  PID:1124