593069537e17bde79a4c8fa982929067512a05fc1ad140e551a9017d37fd4f92

Analysis

max time kernel
7s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/10/2022, 01:46

Target

593069537e17bde79a4c8fa982929067512a05fc1ad140e551a9017d37fd4f92.exe
Size

65KB
MD5

445df3b3aff8750ba40b48b7894d36b0
SHA1

b7f13266a0dec9b3043c8f9cf4fb38da338f9520
SHA256

593069537e17bde79a4c8fa982929067512a05fc1ad140e551a9017d37fd4f92
SHA512

4812ffc561dbe89866dad2ce1905641d13553e65e39d4efee66fe47030ecf9a05e675e436623d4f8e552a091e259c4f984e8cbc7692fadd53b2f282ce2d2cc7d
SSDEEP

1536:CSDEAbR1qItKokmIV5nLXwMY9nFnZB/MATyg1kULkwm4zrJCE1d:CEbYokmIV5nLANHB/MABktkrJCE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1492	1528	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 1492	1528	593069537e17bde79a4c8fa982929067512a05fc1ad140e551a9017d37fd4f92.exe	27
PID 1528 wrote to memory of 1492	1528	593069537e17bde79a4c8fa982929067512a05fc1ad140e551a9017d37fd4f92.exe	27
PID 1528 wrote to memory of 1492	1528	593069537e17bde79a4c8fa982929067512a05fc1ad140e551a9017d37fd4f92.exe	27
PID 1528 wrote to memory of 1492	1528	593069537e17bde79a4c8fa982929067512a05fc1ad140e551a9017d37fd4f92.exe	27

C:\Users\Admin\AppData\Local\Temp\593069537e17bde79a4c8fa982929067512a05fc1ad140e551a9017d37fd4f92.exe
"C:\Users\Admin\AppData\Local\Temp\593069537e17bde79a4c8fa982929067512a05fc1ad140e551a9017d37fd4f92.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 148
  2⤵
  - Program crash
  PID:1492

memory/1528-55-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download