a5e7a41165bb55888ffd79e8ed6e8af888854c5a6910ffb6018fc734b58e124b

Analysis

max time kernel
26s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 12:17

Target

a5e7a41165bb55888ffd79e8ed6e8af888854c5a6910ffb6018fc734b58e124b.exe
Size

36KB
MD5

0d08ade22ca1250f4c82f6e691187beb
SHA1

574cb2b0b2faa3d32b0a9c9be48b0ee1f774b8f9
SHA256

a5e7a41165bb55888ffd79e8ed6e8af888854c5a6910ffb6018fc734b58e124b
SHA512

abecd3a395d6391e68fc5210254f6bb76f5b921f040e347dc41b9d5694ef0cbfeac480f46401df8aed01585dfa68bcd78fd4f8b3eca582a855916e4718afc876
SSDEEP

384:6fGe/qIltTk7ey7KSR5HDFDJz9nDABReb0SUp5ZK44VjiGESI2nlxHjN6/Wvil1:FevwKSRD99n8ygLpHK44VjrEBSfBal

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1732	1636	WerFault.exe	13

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1732	1636	a5e7a41165bb55888ffd79e8ed6e8af888854c5a6910ffb6018fc734b58e124b.exe	27
PID 1636 wrote to memory of 1732	1636	a5e7a41165bb55888ffd79e8ed6e8af888854c5a6910ffb6018fc734b58e124b.exe	27
PID 1636 wrote to memory of 1732	1636	a5e7a41165bb55888ffd79e8ed6e8af888854c5a6910ffb6018fc734b58e124b.exe	27
PID 1636 wrote to memory of 1732	1636	a5e7a41165bb55888ffd79e8ed6e8af888854c5a6910ffb6018fc734b58e124b.exe	27

C:\Users\Admin\AppData\Local\Temp\a5e7a41165bb55888ffd79e8ed6e8af888854c5a6910ffb6018fc734b58e124b.exe
"C:\Users\Admin\AppData\Local\Temp\a5e7a41165bb55888ffd79e8ed6e8af888854c5a6910ffb6018fc734b58e124b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 48
  2⤵
  - Program crash
  PID:1732