516bc65b0d98001134a7b53e1459607011f0690c411a9f4e3800c1872a416dfa

Analysis

max time kernel
48s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 07:36

Target

516bc65b0d98001134a7b53e1459607011f0690c411a9f4e3800c1872a416dfa.exe
Size

56KB
MD5

5c17f87bd0162258540665c21ec0f631
SHA1

e9c36637ed4fae1d435957c24e3889a34fa1f2db
SHA256

516bc65b0d98001134a7b53e1459607011f0690c411a9f4e3800c1872a416dfa
SHA512

06689561b6bf2d67f293d4b671da94790a32d39fb0d77aa1790eec2bdfdf5060b1bf7cdf7b04f8ef94c581d830788ab67632f79cbe45473545c21813c6075a50
SSDEEP

1536:XhGYPxeZiNRkFXql3vGS9MT0jXgP/fdVk22Xg4BtucJ6hx:gL67vj/INVk22wGtDAL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1524	1288	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 1524	1288	516bc65b0d98001134a7b53e1459607011f0690c411a9f4e3800c1872a416dfa.exe	27
PID 1288 wrote to memory of 1524	1288	516bc65b0d98001134a7b53e1459607011f0690c411a9f4e3800c1872a416dfa.exe	27
PID 1288 wrote to memory of 1524	1288	516bc65b0d98001134a7b53e1459607011f0690c411a9f4e3800c1872a416dfa.exe	27
PID 1288 wrote to memory of 1524	1288	516bc65b0d98001134a7b53e1459607011f0690c411a9f4e3800c1872a416dfa.exe	27

C:\Users\Admin\AppData\Local\Temp\516bc65b0d98001134a7b53e1459607011f0690c411a9f4e3800c1872a416dfa.exe
"C:\Users\Admin\AppData\Local\Temp\516bc65b0d98001134a7b53e1459607011f0690c411a9f4e3800c1872a416dfa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 36
  2⤵
  - Program crash
  PID:1524

memory/1288-55-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download