5c6145967c1c02b79417a20d89e1f1cb2512b3c32146b157daa85d890fdd6480

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
10/10/2022, 19:18

Target

5c6145967c1c02b79417a20d89e1f1cb2512b3c32146b157daa85d890fdd6480.exe
Size

268KB
MD5

79192fece96c5a8d27fab720eb5e6bd3
SHA1

339b0aceeab3f55247c96e5ab4af28e491ae25f1
SHA256

5c6145967c1c02b79417a20d89e1f1cb2512b3c32146b157daa85d890fdd6480
SHA512

42ee980a0d2c4066c7bd049749490e414caaf59e655741ba6fb49b14805df43b06fb0fc157df7f0c76e7c3f67ae915f8dbbb77938ff932c4af7d69828bb1a69d
SSDEEP

3072:gr0tgXV393wq7d9M5zDxvNiWVoEgYqY5QOssNnh3:htgXV3iSd9M5BvNi+5lXX3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
836	1044	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 836	1044	5c6145967c1c02b79417a20d89e1f1cb2512b3c32146b157daa85d890fdd6480.exe	27
PID 1044 wrote to memory of 836	1044	5c6145967c1c02b79417a20d89e1f1cb2512b3c32146b157daa85d890fdd6480.exe	27
PID 1044 wrote to memory of 836	1044	5c6145967c1c02b79417a20d89e1f1cb2512b3c32146b157daa85d890fdd6480.exe	27
PID 1044 wrote to memory of 836	1044	5c6145967c1c02b79417a20d89e1f1cb2512b3c32146b157daa85d890fdd6480.exe	27

C:\Users\Admin\AppData\Local\Temp\5c6145967c1c02b79417a20d89e1f1cb2512b3c32146b157daa85d890fdd6480.exe
"C:\Users\Admin\AppData\Local\Temp\5c6145967c1c02b79417a20d89e1f1cb2512b3c32146b157daa85d890fdd6480.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 196
  2⤵
  - Program crash
  PID:836