5c94fea0b25f032f0f416a1dc7994a333722109c6ee285b2866ad57bade003d0

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 21:57

Target

5c94fea0b25f032f0f416a1dc7994a333722109c6ee285b2866ad57bade003d0.exe
Size

208KB
MD5

f8cbad8fe22bad3a7698fd7f9681ba96
SHA1

8a9d8f5033506e141529d9e1d2651c904aa4e9ad
SHA256

5c94fea0b25f032f0f416a1dc7994a333722109c6ee285b2866ad57bade003d0
SHA512

67c5ced4b45b35fee7dba9cf96d2ddbda9270a42dc357335ee5971549d705ba2cef86983dbe9959b98a12f432e0a8a9fc3e8c2cf4618665d363450996ecd5bb6
SSDEEP

3072:3ePg6ctxGv4QcU9KQ2BBA2waPxDt/ol+:j6ctxGsWKQ2Bx5x5r

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
956	996	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 956	996	5c94fea0b25f032f0f416a1dc7994a333722109c6ee285b2866ad57bade003d0.exe	27
PID 996 wrote to memory of 956	996	5c94fea0b25f032f0f416a1dc7994a333722109c6ee285b2866ad57bade003d0.exe	27
PID 996 wrote to memory of 956	996	5c94fea0b25f032f0f416a1dc7994a333722109c6ee285b2866ad57bade003d0.exe	27
PID 996 wrote to memory of 956	996	5c94fea0b25f032f0f416a1dc7994a333722109c6ee285b2866ad57bade003d0.exe	27

C:\Users\Admin\AppData\Local\Temp\5c94fea0b25f032f0f416a1dc7994a333722109c6ee285b2866ad57bade003d0.exe
"C:\Users\Admin\AppData\Local\Temp\5c94fea0b25f032f0f416a1dc7994a333722109c6ee285b2866ad57bade003d0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 996 -s 124
  2⤵
  - Program crash
  PID:956

memory/996-55-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download