5b84fad483e14eb818356163ce43def64f4f896873a5e33f53a8c20f2575558c

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-10-2022 14:55

Target

25c494be7cc883f161e94a308f65d6a4cac7db25bf3563c1ebe1488fa7526a3f_unpacked.exe
Size

905KB
MD5

caea68a0bc6a5e6f678f0242e84ff61a
SHA1

f3de5be1413d9bbf3eabc1c113bc8dd07b71179a
SHA256

25c494be7cc883f161e94a308f65d6a4cac7db25bf3563c1ebe1488fa7526a3f
SHA512

56f03c58c8e8a488df7b031684974b1a7df5ab902f006989d045b2ee04627def7385e44c1f6ad8298d6747c1945f28282013aa58ef30fea81dda24b0914b0095
SSDEEP

12288:DSXbvF18V+l1EtQxbT84WvSn/gSKx6wCPFWoTwCT/VOUFYsfSmII07:DSp170tK/PFWmAUp/

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1036 1388 WerFault.exe 25c494be7cc883f161e94a308f65d6a4cac7db25bf3563c1ebe1488fa7526a3f_unpacked.exe

pid	pid_target	process	target process
1036	1388	WerFault.exe	25c494be7cc883f161e94a308f65d6a4cac7db25bf3563c1ebe1488fa7526a3f_unpacked.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

25c494be7cc883f161e94a308f65d6a4cac7db25bf3563c1ebe1488fa7526a3f_unpacked.exe

description	pid	process	target process
PID 1388 wrote to memory of 1036	1388	25c494be7cc883f161e94a308f65d6a4cac7db25bf3563c1ebe1488fa7526a3f_unpacked.exe	WerFault.exe
PID 1388 wrote to memory of 1036	1388	25c494be7cc883f161e94a308f65d6a4cac7db25bf3563c1ebe1488fa7526a3f_unpacked.exe	WerFault.exe
PID 1388 wrote to memory of 1036	1388	25c494be7cc883f161e94a308f65d6a4cac7db25bf3563c1ebe1488fa7526a3f_unpacked.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\25c494be7cc883f161e94a308f65d6a4cac7db25bf3563c1ebe1488fa7526a3f_unpacked.exe
"C:\Users\Admin\AppData\Local\Temp\25c494be7cc883f161e94a308f65d6a4cac7db25bf3563c1ebe1488fa7526a3f_unpacked.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1388

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1388 -s 20
2⤵
- Program crash
PID:1036