5fecac5b85c788ea5efd8938ab58913262583590ea61a6dc626f84134e09ca4f

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 14:58

Target

5fecac5b85c788ea5efd8938ab58913262583590ea61a6dc626f84134e09ca4f.exe
Size

350KB
MD5

81bfca2e298c7e199438542b2bf6f8cd
SHA1

a21ca57b52f3f4b6292e529d72028c545d4b6099
SHA256

5fecac5b85c788ea5efd8938ab58913262583590ea61a6dc626f84134e09ca4f
SHA512

41f073710aa94c6f683c19328b6a8d3f31789078e55b07b1e88dc4e392fff23773ab4bad80c473636ba5f30fc9b31b43856ae81f8b64df057c7a5df96a86eca1
SSDEEP

6144:zdafrF9GOsBreY+DmipkKlMG6rPfnxeg2bceK3BbRVGGG7RrAJekc:zkfiOswVpDMG6LnxeJ0Rr7G7RrDk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
944	1696	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 944	1696	5fecac5b85c788ea5efd8938ab58913262583590ea61a6dc626f84134e09ca4f.exe	27
PID 1696 wrote to memory of 944	1696	5fecac5b85c788ea5efd8938ab58913262583590ea61a6dc626f84134e09ca4f.exe	27
PID 1696 wrote to memory of 944	1696	5fecac5b85c788ea5efd8938ab58913262583590ea61a6dc626f84134e09ca4f.exe	27
PID 1696 wrote to memory of 944	1696	5fecac5b85c788ea5efd8938ab58913262583590ea61a6dc626f84134e09ca4f.exe	27

C:\Users\Admin\AppData\Local\Temp\5fecac5b85c788ea5efd8938ab58913262583590ea61a6dc626f84134e09ca4f.exe
"C:\Users\Admin\AppData\Local\Temp\5fecac5b85c788ea5efd8938ab58913262583590ea61a6dc626f84134e09ca4f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 36
  2⤵
  - Program crash
  PID:944

memory/1696-55-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download