0d5e04f1f88c5b5c352f13d8482c02bf6db2ff43c8be785c9681a6069b3e6dd2

Analysis

max time kernel
36s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 21:53

Target

0d5e04f1f88c5b5c352f13d8482c02bf6db2ff43c8be785c9681a6069b3e6dd2.exe
Size

28KB
MD5

4a45a30c44ba7a7628e10ad17b6bb676
SHA1

b4023beb9506f4bba25c00c3781b7f9e5aaf55ad
SHA256

0d5e04f1f88c5b5c352f13d8482c02bf6db2ff43c8be785c9681a6069b3e6dd2
SHA512

fdcbcae29853e221a644c49ef9919c286affa52f3e9b32cd1ef82ef28481acbda44cd09749628fc723e7a107b1bb2bfd3d217299f344b7b53145378b4697ffab
SSDEEP

384:MIQHxbsTwgDCWeXWZulADuRP47dJROZv4Hzs9hNj+EROr0bC/c6YWXHo9WilNSYy:qtGZUxOHg7tI0C/a7lEYXsSpdQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1900	1160	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1900	1160	0d5e04f1f88c5b5c352f13d8482c02bf6db2ff43c8be785c9681a6069b3e6dd2.exe	27
PID 1160 wrote to memory of 1900	1160	0d5e04f1f88c5b5c352f13d8482c02bf6db2ff43c8be785c9681a6069b3e6dd2.exe	27
PID 1160 wrote to memory of 1900	1160	0d5e04f1f88c5b5c352f13d8482c02bf6db2ff43c8be785c9681a6069b3e6dd2.exe	27
PID 1160 wrote to memory of 1900	1160	0d5e04f1f88c5b5c352f13d8482c02bf6db2ff43c8be785c9681a6069b3e6dd2.exe	27

C:\Users\Admin\AppData\Local\Temp\0d5e04f1f88c5b5c352f13d8482c02bf6db2ff43c8be785c9681a6069b3e6dd2.exe
"C:\Users\Admin\AppData\Local\Temp\0d5e04f1f88c5b5c352f13d8482c02bf6db2ff43c8be785c9681a6069b3e6dd2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 104
  2⤵
  - Program crash
  PID:1900