5b888999a49f5deaa732fd39b6adbe7c83a9f51659a65a10224a79e94a9bb84e

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 09:16

Target

5b888999a49f5deaa732fd39b6adbe7c83a9f51659a65a10224a79e94a9bb84e.exe
Size

292KB
MD5

24a033790a120708e54d2ee7a95b0ea0
SHA1

4934fc49f316b075960d678ad68b0352ce06cf2a
SHA256

5b888999a49f5deaa732fd39b6adbe7c83a9f51659a65a10224a79e94a9bb84e
SHA512

a3a3f00ca5db4495d73e2cc13158df3423ba8d2834a66a6f8fad80eeaf8dd488a8696eb5dbfedf72bd9faa6944e9a15d2d02d42086149fb5cfbdd33a7ada74a8
SSDEEP

6144:ptcCya+AWLB7qHoAn1qi93wbLXeyIBbOzciQXdP:p+CyhAWd72oAnvlwbLhIROzcicd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1312	1732	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1312	1732	5b888999a49f5deaa732fd39b6adbe7c83a9f51659a65a10224a79e94a9bb84e.exe	28
PID 1732 wrote to memory of 1312	1732	5b888999a49f5deaa732fd39b6adbe7c83a9f51659a65a10224a79e94a9bb84e.exe	28
PID 1732 wrote to memory of 1312	1732	5b888999a49f5deaa732fd39b6adbe7c83a9f51659a65a10224a79e94a9bb84e.exe	28
PID 1732 wrote to memory of 1312	1732	5b888999a49f5deaa732fd39b6adbe7c83a9f51659a65a10224a79e94a9bb84e.exe	28

C:\Users\Admin\AppData\Local\Temp\5b888999a49f5deaa732fd39b6adbe7c83a9f51659a65a10224a79e94a9bb84e.exe
"C:\Users\Admin\AppData\Local\Temp\5b888999a49f5deaa732fd39b6adbe7c83a9f51659a65a10224a79e94a9bb84e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 132
  2⤵
  - Program crash
  PID:1312

memory/1732-55-0x0000000000EF0000-0x0000000000F3F000-memory.dmp

Filesize
316KB

Download