15a5bb8741740939e79938ed1e2e50e2339ccf60594969077417f1c1853e2bb9

Analysis

max time kernel
4s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:35

Target

15a5bb8741740939e79938ed1e2e50e2339ccf60594969077417f1c1853e2bb9.exe
Size

63KB
MD5

4314c20e9ab7303d8703166eed901d90
SHA1

a8b0e26f0833cfb80e1ff7111e7452520da3b00a
SHA256

15a5bb8741740939e79938ed1e2e50e2339ccf60594969077417f1c1853e2bb9
SHA512

27cb87a59142a4b0ccdbaa8350a20a3501f7ea9a84cdbb458c043c8c0cb4690084fa623297854a019d71a0cd37a724c1c17216da750324a09e4ae83d2478db4d
SSDEEP

1536:3FEjiAzzoNHbX79++cPafo7pmTmb8UnlT:VEjpwo+cPaBTmb/1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1332	1236	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 1332	1236	15a5bb8741740939e79938ed1e2e50e2339ccf60594969077417f1c1853e2bb9.exe	28
PID 1236 wrote to memory of 1332	1236	15a5bb8741740939e79938ed1e2e50e2339ccf60594969077417f1c1853e2bb9.exe	28
PID 1236 wrote to memory of 1332	1236	15a5bb8741740939e79938ed1e2e50e2339ccf60594969077417f1c1853e2bb9.exe	28
PID 1236 wrote to memory of 1332	1236	15a5bb8741740939e79938ed1e2e50e2339ccf60594969077417f1c1853e2bb9.exe	28

C:\Users\Admin\AppData\Local\Temp\15a5bb8741740939e79938ed1e2e50e2339ccf60594969077417f1c1853e2bb9.exe
"C:\Users\Admin\AppData\Local\Temp\15a5bb8741740939e79938ed1e2e50e2339ccf60594969077417f1c1853e2bb9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 36
  2⤵
  - Program crash
  PID:1332

memory/1236-55-0x0000000000400000-0x0000000000426489-memory.dmp

Filesize
153KB

Download