593baeb985128c52a8469125f36e9d2da293e56377b19bebdf3e9df4c875d3f9

Analysis

max time kernel
33s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 23:53

Target

593baeb985128c52a8469125f36e9d2da293e56377b19bebdf3e9df4c875d3f9.exe
Size

100KB
MD5

33e69fa2bf6a3c62cdfa9e78da5845c0
SHA1

d6f9a0d6db4d1e58ebc6e6ae168769d106af60d9
SHA256

593baeb985128c52a8469125f36e9d2da293e56377b19bebdf3e9df4c875d3f9
SHA512

9ce039d58fac365f286e528d0adefffa0e8690aaa66e44f6d7678d04c5063c0872925d60bc240cbed96db5a2ad6adce976ead77b4bdaf5789944a786a98e9ef9
SSDEEP

1536:VhhNF3sdUNXKTzQI1pjsGYD0xqtvPeg0T3iDC9ZCsp8RC94Xn5xLKQMUF2hrB:VhhNF2NpjnYD08tnETzTC7LQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
544	2036	WerFault.exe	20

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 544	2036	593baeb985128c52a8469125f36e9d2da293e56377b19bebdf3e9df4c875d3f9.exe	26
PID 2036 wrote to memory of 544	2036	593baeb985128c52a8469125f36e9d2da293e56377b19bebdf3e9df4c875d3f9.exe	26
PID 2036 wrote to memory of 544	2036	593baeb985128c52a8469125f36e9d2da293e56377b19bebdf3e9df4c875d3f9.exe	26
PID 2036 wrote to memory of 544	2036	593baeb985128c52a8469125f36e9d2da293e56377b19bebdf3e9df4c875d3f9.exe	26

C:\Users\Admin\AppData\Local\Temp\593baeb985128c52a8469125f36e9d2da293e56377b19bebdf3e9df4c875d3f9.exe
"C:\Users\Admin\AppData\Local\Temp\593baeb985128c52a8469125f36e9d2da293e56377b19bebdf3e9df4c875d3f9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 44
  2⤵
  - Program crash
  PID:544