5cc15956e081b113955aa82356912fc21878db1d34e5037f230a5c068b249bca

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 18:24

Target

5cc15956e081b113955aa82356912fc21878db1d34e5037f230a5c068b249bca.exe
Size

483KB
MD5

4385ccf2a9cda0dcd34e04701a84051d
SHA1

fcff233674fff4aae2c7ef4b5404eaea4b7ca55f
SHA256

5cc15956e081b113955aa82356912fc21878db1d34e5037f230a5c068b249bca
SHA512

c31ce2b141748ea8fdaae50fb7bd18781da7e5d85e19a915af6e24166adfc8a0d6dc3d78f7813c20cb9df2815b9c77a3f07741a9bca8a4c6926807b19da4c46b
SSDEEP

6144:ioLY3VafUTGekL7sHRn+ZZGzLI2hXWaBn4GgmRhXjxS6fgALAo4pg+dFu121GvOl:+MU/kviR+WzE2lBFr5zpN2EFBLehuq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1156	1600	WerFault.exe	26

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1156	1600	5cc15956e081b113955aa82356912fc21878db1d34e5037f230a5c068b249bca.exe	27
PID 1600 wrote to memory of 1156	1600	5cc15956e081b113955aa82356912fc21878db1d34e5037f230a5c068b249bca.exe	27
PID 1600 wrote to memory of 1156	1600	5cc15956e081b113955aa82356912fc21878db1d34e5037f230a5c068b249bca.exe	27
PID 1600 wrote to memory of 1156	1600	5cc15956e081b113955aa82356912fc21878db1d34e5037f230a5c068b249bca.exe	27
PID 1600 wrote to memory of 1156	1600	5cc15956e081b113955aa82356912fc21878db1d34e5037f230a5c068b249bca.exe	27
PID 1600 wrote to memory of 1156	1600	5cc15956e081b113955aa82356912fc21878db1d34e5037f230a5c068b249bca.exe	27
PID 1600 wrote to memory of 1156	1600	5cc15956e081b113955aa82356912fc21878db1d34e5037f230a5c068b249bca.exe	27

C:\Users\Admin\AppData\Local\Temp\5cc15956e081b113955aa82356912fc21878db1d34e5037f230a5c068b249bca.exe
"C:\Users\Admin\AppData\Local\Temp\5cc15956e081b113955aa82356912fc21878db1d34e5037f230a5c068b249bca.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 256
  2⤵
  - Program crash
  PID:1156

memory/1600-54-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download
memory/1600-56-0x0000000030000000-0x00000000300C1000-memory.dmp

Filesize
772KB

Download
memory/1600-57-0x00000000007C0000-0x0000000000881000-memory.dmp

Filesize
772KB

Download