d5c0d4ca89b60c8854d684915f605c867b39b22075ddf806f83b14fca89fcc8b

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 05:35

Target

d5c0d4ca89b60c8854d684915f605c867b39b22075ddf806f83b14fca89fcc8b.exe
Size

958KB
MD5

6c03c9da624a7951ac8061c6b8b62cc6
SHA1

c23cb65233b8c31684bcbeddd05b549f5fe3a662
SHA256

d5c0d4ca89b60c8854d684915f605c867b39b22075ddf806f83b14fca89fcc8b
SHA512

0de0f8b08bc29ecdf29a1c1218a8cfdaba90c87d9b6ad750c1d3d57c58497e49f530118ece20705c1987a01618abab70d78f4b1e8e14371fa1a5aadc3574f4ff
SSDEEP

24576:eb/AIz4yE918BHeYT290zCX7Q60XPj1SoJ:M/xjxeXLeJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
904	1588	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 904	1588	d5c0d4ca89b60c8854d684915f605c867b39b22075ddf806f83b14fca89fcc8b.exe	27
PID 1588 wrote to memory of 904	1588	d5c0d4ca89b60c8854d684915f605c867b39b22075ddf806f83b14fca89fcc8b.exe	27
PID 1588 wrote to memory of 904	1588	d5c0d4ca89b60c8854d684915f605c867b39b22075ddf806f83b14fca89fcc8b.exe	27
PID 1588 wrote to memory of 904	1588	d5c0d4ca89b60c8854d684915f605c867b39b22075ddf806f83b14fca89fcc8b.exe	27

C:\Users\Admin\AppData\Local\Temp\d5c0d4ca89b60c8854d684915f605c867b39b22075ddf806f83b14fca89fcc8b.exe
"C:\Users\Admin\AppData\Local\Temp\d5c0d4ca89b60c8854d684915f605c867b39b22075ddf806f83b14fca89fcc8b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 164
  2⤵
  - Program crash
  PID:904

memory/1588-54-0x0000000075661000-0x0000000075663000-memory.dmp

Filesize
8KB

Download
memory/1588-56-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download