5c7e4bb347ec43a4392e97124f1a3e602e778bda8112ac0697b2a5998e62d15b

Analysis

max time kernel
179s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 23:21

Target

5c7e4bb347ec43a4392e97124f1a3e602e778bda8112ac0697b2a5998e62d15b.exe
Size

64KB
MD5

67499107354919b8872e1d6e23af5c60
SHA1

b8f0ec318d117a17d3aa85caac92fe214b5dc319
SHA256

5c7e4bb347ec43a4392e97124f1a3e602e778bda8112ac0697b2a5998e62d15b
SHA512

7b5fd84ec897b2a57e143f3f70ed72ef8ef88319e62b1061bdc7d935133550106a93c75dc502213ac240495649691a6245dfd888b40fda3db995eaac1cc36ee0
SSDEEP

1536:humPCmESUHNdSY+A37feaCMJDmYsLIb4PvYqHB/AdG2:1UHNdSDADeak7dJHB/AdG2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1376	1600	WerFault.exe	15

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1376	1600	5c7e4bb347ec43a4392e97124f1a3e602e778bda8112ac0697b2a5998e62d15b.exe	28
PID 1600 wrote to memory of 1376	1600	5c7e4bb347ec43a4392e97124f1a3e602e778bda8112ac0697b2a5998e62d15b.exe	28
PID 1600 wrote to memory of 1376	1600	5c7e4bb347ec43a4392e97124f1a3e602e778bda8112ac0697b2a5998e62d15b.exe	28
PID 1600 wrote to memory of 1376	1600	5c7e4bb347ec43a4392e97124f1a3e602e778bda8112ac0697b2a5998e62d15b.exe	28
PID 1600 wrote to memory of 1376	1600	5c7e4bb347ec43a4392e97124f1a3e602e778bda8112ac0697b2a5998e62d15b.exe	28
PID 1600 wrote to memory of 1376	1600	5c7e4bb347ec43a4392e97124f1a3e602e778bda8112ac0697b2a5998e62d15b.exe	28
PID 1600 wrote to memory of 1376	1600	5c7e4bb347ec43a4392e97124f1a3e602e778bda8112ac0697b2a5998e62d15b.exe	28

C:\Users\Admin\AppData\Local\Temp\5c7e4bb347ec43a4392e97124f1a3e602e778bda8112ac0697b2a5998e62d15b.exe
"C:\Users\Admin\AppData\Local\Temp\5c7e4bb347ec43a4392e97124f1a3e602e778bda8112ac0697b2a5998e62d15b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 264
  2⤵
  - Program crash
  PID:1376

memory/1600-54-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1600-55-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/1600-57-0x0000000000030000-0x0000000000040000-memory.dmp

Filesize
64KB

Download
memory/1600-58-0x0000000000030000-0x0000000000040000-memory.dmp

Filesize
64KB

Download
memory/1600-59-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download