e534f57455f5105d7a2fb0462cacd91b749714f51cf7bb20ba0826e4c648904c

Analysis

max time kernel
30s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-10-2022 17:24

Target

e534f57455f5105d7a2fb0462cacd91b749714f51cf7bb20ba0826e4c648904c.exe
Size

430KB
MD5

6f9d1ec42a9a76696cc3961b456feaa0
SHA1

3615614c37457dc9a65fe99f2b378fad68030949
SHA256

e534f57455f5105d7a2fb0462cacd91b749714f51cf7bb20ba0826e4c648904c
SHA512

850e1427606a6331bdfed647570e7516084c396adf8b14ae75818ccc8e7ca0a831be8d8ee47d3d59df4acbd543718db32f9d1252084eca1ea1fe6cba166e45d9
SSDEEP

6144:vbX8E5CfEnSD+zkrK6QtMxXN7XTNBr7TdG1VANWZ5Yf54J2QzQSJXn7cZU+f5Z+H:DP7K+zxh+T7DNFBGkNwgWaf5LE/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1400	1508	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 1400	1508	e534f57455f5105d7a2fb0462cacd91b749714f51cf7bb20ba0826e4c648904c.exe	26
PID 1508 wrote to memory of 1400	1508	e534f57455f5105d7a2fb0462cacd91b749714f51cf7bb20ba0826e4c648904c.exe	26
PID 1508 wrote to memory of 1400	1508	e534f57455f5105d7a2fb0462cacd91b749714f51cf7bb20ba0826e4c648904c.exe	26
PID 1508 wrote to memory of 1400	1508	e534f57455f5105d7a2fb0462cacd91b749714f51cf7bb20ba0826e4c648904c.exe	26

C:\Users\Admin\AppData\Local\Temp\e534f57455f5105d7a2fb0462cacd91b749714f51cf7bb20ba0826e4c648904c.exe
"C:\Users\Admin\AppData\Local\Temp\e534f57455f5105d7a2fb0462cacd91b749714f51cf7bb20ba0826e4c648904c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 88
  2⤵
  - Program crash
  PID:1400

memory/1508-54-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download