5926e41f22d65e6cf015a84cbe16f9b3b5abb2ea7de761dac2122bad579b16fc

Analysis

max time kernel
29s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 08:50

Target

5926e41f22d65e6cf015a84cbe16f9b3b5abb2ea7de761dac2122bad579b16fc.exe
Size

300KB
MD5

30e14629de1d807662e5860ac90a8650
SHA1

a5f4fbec1ba3eb45490b2f489a45901b6bf6dbd5
SHA256

5926e41f22d65e6cf015a84cbe16f9b3b5abb2ea7de761dac2122bad579b16fc
SHA512

eb3922c70c2eb83bc98a3f242cacaf80c11c15e718e563b5e0f079538e73b1404fa6237a38e8fe1fd261ccbfee55b6b8cd4474fdea351d230923a233e2e506f2
SSDEEP

3072:oiTeTY1vm5WBqwP3fseQ/Xz7iasXBlC/hX6mxv34Ut7VkMiKxj8BPOI5s8Dxnj8J:TiTyiWB01L7tMw53p34EZ94G7a4G7v0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1320	1732	WerFault.exe	19

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1320	1732	5926e41f22d65e6cf015a84cbe16f9b3b5abb2ea7de761dac2122bad579b16fc.exe	27
PID 1732 wrote to memory of 1320	1732	5926e41f22d65e6cf015a84cbe16f9b3b5abb2ea7de761dac2122bad579b16fc.exe	27
PID 1732 wrote to memory of 1320	1732	5926e41f22d65e6cf015a84cbe16f9b3b5abb2ea7de761dac2122bad579b16fc.exe	27
PID 1732 wrote to memory of 1320	1732	5926e41f22d65e6cf015a84cbe16f9b3b5abb2ea7de761dac2122bad579b16fc.exe	27

C:\Users\Admin\AppData\Local\Temp\5926e41f22d65e6cf015a84cbe16f9b3b5abb2ea7de761dac2122bad579b16fc.exe
"C:\Users\Admin\AppData\Local\Temp\5926e41f22d65e6cf015a84cbe16f9b3b5abb2ea7de761dac2122bad579b16fc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 164
  2⤵
  - Program crash
  PID:1320

memory/1732-54-0x0000000075771000-0x0000000075773000-memory.dmp

Filesize
8KB

Download