5b1cd50fd699ace6612743a4068c2b17927d16a36d3e4a37a7963b58317c3fef

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 19:03

Target

5b1cd50fd699ace6612743a4068c2b17927d16a36d3e4a37a7963b58317c3fef.exe
Size

293KB
MD5

0c27abd0469466401a6f20699ff070c0
SHA1

28e0fd5c6bf81cbf01fd132995964c6733cc5c01
SHA256

5b1cd50fd699ace6612743a4068c2b17927d16a36d3e4a37a7963b58317c3fef
SHA512

bd68c16686165b95f090cd1a1f942360e55f5d80b12a65b7233fda56e406af8c70989b414aae37141d055b3306beffd75fc5d14dd4a3185d428d7b266ed3a98e
SSDEEP

6144:MAC6iCyq7Sc9opKLIaNBZfiKrkiUZTSJs6mXEbY9kG6o08n:rCyP7ScNsqTkiu/pUbY2Gjn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1188	832	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 1188	832	5b1cd50fd699ace6612743a4068c2b17927d16a36d3e4a37a7963b58317c3fef.exe	27
PID 832 wrote to memory of 1188	832	5b1cd50fd699ace6612743a4068c2b17927d16a36d3e4a37a7963b58317c3fef.exe	27
PID 832 wrote to memory of 1188	832	5b1cd50fd699ace6612743a4068c2b17927d16a36d3e4a37a7963b58317c3fef.exe	27
PID 832 wrote to memory of 1188	832	5b1cd50fd699ace6612743a4068c2b17927d16a36d3e4a37a7963b58317c3fef.exe	27

C:\Users\Admin\AppData\Local\Temp\5b1cd50fd699ace6612743a4068c2b17927d16a36d3e4a37a7963b58317c3fef.exe
"C:\Users\Admin\AppData\Local\Temp\5b1cd50fd699ace6612743a4068c2b17927d16a36d3e4a37a7963b58317c3fef.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 832 -s 180
  2⤵
  - Program crash
  PID:1188

memory/832-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/832-56-0x0000000001070000-0x00000000010BD000-memory.dmp

Filesize
308KB

Download