5f03c87baf26738dcf7b8e5d79e175942233bd283039d4e66ec6967b123019a4

Analysis

max time kernel
36s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 17:20

Target

5f03c87baf26738dcf7b8e5d79e175942233bd283039d4e66ec6967b123019a4.exe
Size

632KB
MD5

a0f9db8541f8fe2d782bc0d0a7cc8995
SHA1

25c117790d6374b6c7f807d7ed8419b3e5837582
SHA256

5f03c87baf26738dcf7b8e5d79e175942233bd283039d4e66ec6967b123019a4
SHA512

689fa39115ac6385ddfb5c1155f9619eb8c2cf82c9d16ce440ddf4a99bb9d5477b328cd12a9f8057fba481ab21e2496409e0980ca38248b620c1b2902976a34f
SSDEEP

12288:6U6OUauNWXk4d8nBGPHOB1GGF3Z4mxxRuxm1EZi9XxF9E2AGs:63zWXk9nwPHqhQmXow1wi9D9E2AP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
112	1116	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 112	1116	5f03c87baf26738dcf7b8e5d79e175942233bd283039d4e66ec6967b123019a4.exe	26
PID 1116 wrote to memory of 112	1116	5f03c87baf26738dcf7b8e5d79e175942233bd283039d4e66ec6967b123019a4.exe	26
PID 1116 wrote to memory of 112	1116	5f03c87baf26738dcf7b8e5d79e175942233bd283039d4e66ec6967b123019a4.exe	26
PID 1116 wrote to memory of 112	1116	5f03c87baf26738dcf7b8e5d79e175942233bd283039d4e66ec6967b123019a4.exe	26

C:\Users\Admin\AppData\Local\Temp\5f03c87baf26738dcf7b8e5d79e175942233bd283039d4e66ec6967b123019a4.exe
"C:\Users\Admin\AppData\Local\Temp\5f03c87baf26738dcf7b8e5d79e175942233bd283039d4e66ec6967b123019a4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 160
  2⤵
  - Program crash
  PID:112

memory/1116-54-0x0000000000400000-0x00000000005CF000-memory.dmp

Filesize
1.8MB

Download
memory/1116-55-0x00000000002C0000-0x0000000000314000-memory.dmp

Filesize
336KB

Download
memory/1116-57-0x0000000000400000-0x00000000005CF000-memory.dmp

Filesize
1.8MB

Download
memory/1116-58-0x00000000002C0000-0x0000000000314000-memory.dmp

Filesize
336KB

Download