5cad6827c64facb11d5112646302961effcca42bafa798d0385df6b12cf4b42a

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 09:32

Target

is154619.exe
Size

92KB
MD5

fa98cfc3ed3127d5f6430804ed34190b
SHA1

1e7eb241ccb933570066328c769339b6e0ad1481
SHA256

95469c882c723ef115157ae44f64f42553ae562dab0c5d3f3ea0f2b031576590
SHA512

c68dfcad09730e8a3867d57c731280624e9fc25d0f394fe938b000b82a060869f4fc9f7d3dd055e48121b21c63862cb7647915db8a48a12918177324721acb7d
SSDEEP

1536:hT2+hGSGlxMNYo/lZ0IvOtLLJlWxhwSwWDFwjoM+5gdNefe6LB5GvOUmSWJzw99R:hTVnbNZ0I25VlW7TF+Btue6LB54rmSWW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1932	1896	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 1932	1896	is154619.exe	28
PID 1896 wrote to memory of 1932	1896	is154619.exe	28
PID 1896 wrote to memory of 1932	1896	is154619.exe	28
PID 1896 wrote to memory of 1932	1896	is154619.exe	28

C:\Users\Admin\AppData\Local\Temp\is154619.exe
"C:\Users\Admin\AppData\Local\Temp\is154619.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 88
  2⤵
  - Program crash
  PID:1932

memory/1896-55-0x0000000001B40000-0x0000000001C19000-memory.dmp

Filesize
868KB

Download