5105bc07116bf5ecf880ec03bfe15ddcd095bef2d2b8d432230c939b49474b1c

Analysis

max time kernel
36s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 14:46

Target

5105bc07116bf5ecf880ec03bfe15ddcd095bef2d2b8d432230c939b49474b1c.exe
Size

366KB
MD5

67bcd851aedfa1e4203698c887d506b4
SHA1

59d6e7a7486acaae7b5615868dd1c3a516e2a389
SHA256

5105bc07116bf5ecf880ec03bfe15ddcd095bef2d2b8d432230c939b49474b1c
SHA512

708a879f41555f6ebbf789de86d64496f918c262ae0c1eea98c4d150836b196b01ed4f167efe1cdfcaf746f06121cd77d4bf36aef5282f5ca999c643698aedf3
SSDEEP

3072:aQyqiwqQYy5R8YuuC30uLPBBzXEOeGkaqu1waUFDRL+RlQ9H:aIiwqQYKqeC30wPjz3H52DoC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
788	1612	WerFault.exe	18

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 788	1612	5105bc07116bf5ecf880ec03bfe15ddcd095bef2d2b8d432230c939b49474b1c.exe	26
PID 1612 wrote to memory of 788	1612	5105bc07116bf5ecf880ec03bfe15ddcd095bef2d2b8d432230c939b49474b1c.exe	26
PID 1612 wrote to memory of 788	1612	5105bc07116bf5ecf880ec03bfe15ddcd095bef2d2b8d432230c939b49474b1c.exe	26
PID 1612 wrote to memory of 788	1612	5105bc07116bf5ecf880ec03bfe15ddcd095bef2d2b8d432230c939b49474b1c.exe	26

C:\Users\Admin\AppData\Local\Temp\5105bc07116bf5ecf880ec03bfe15ddcd095bef2d2b8d432230c939b49474b1c.exe
"C:\Users\Admin\AppData\Local\Temp\5105bc07116bf5ecf880ec03bfe15ddcd095bef2d2b8d432230c939b49474b1c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 36
  2⤵
  - Program crash
  PID:788

memory/1612-54-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download