c5883d1c61e5ba12cbe92c37e258abfea9a578aeb58c1f1c75ec9ece51f93f3d

Analysis

max time kernel
27s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:58

Target

c5883d1c61e5ba12cbe92c37e258abfea9a578aeb58c1f1c75ec9ece51f93f3d.exe
Size

669KB
MD5

cf1fff479e3e0e3925e5e1cf37ae1355
SHA1

f98b5cbd0fc7015a11e1f3bb880c2b1dc9c22419
SHA256

c5883d1c61e5ba12cbe92c37e258abfea9a578aeb58c1f1c75ec9ece51f93f3d
SHA512

836d3c3cf04a3d5854a9ac343820ab8b99100c86fe56117b8036a9dfe714345efff2979e4269e77c1028d5cd4e17f123525bb474ea3943de20577faec74842e6
SSDEEP

12288:B5MxDcqIQ4TO6w+1TKvSfsBcex263HbCohnAHKg+nx9+TN4Lh8M3:IZMQZUTKiXFMngKjx9+NXM

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

896 1228 WerFault.exe c5883d1c61e5ba12cbe92c37e258abfea9a578aeb58c1f1c75ec9ece51f93f3d.exe

pid	pid_target	process	target process
896	1228	WerFault.exe	c5883d1c61e5ba12cbe92c37e258abfea9a578aeb58c1f1c75ec9ece51f93f3d.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c5883d1c61e5ba12cbe92c37e258abfea9a578aeb58c1f1c75ec9ece51f93f3d.exe

description	pid	process	target process
PID 1228 wrote to memory of 896	1228	c5883d1c61e5ba12cbe92c37e258abfea9a578aeb58c1f1c75ec9ece51f93f3d.exe	WerFault.exe
PID 1228 wrote to memory of 896	1228	c5883d1c61e5ba12cbe92c37e258abfea9a578aeb58c1f1c75ec9ece51f93f3d.exe	WerFault.exe
PID 1228 wrote to memory of 896	1228	c5883d1c61e5ba12cbe92c37e258abfea9a578aeb58c1f1c75ec9ece51f93f3d.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c5883d1c61e5ba12cbe92c37e258abfea9a578aeb58c1f1c75ec9ece51f93f3d.exe
"C:\Users\Admin\AppData\Local\Temp\c5883d1c61e5ba12cbe92c37e258abfea9a578aeb58c1f1c75ec9ece51f93f3d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1228

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1228 -s 548
2⤵
- Program crash
PID:896

memory/896-55-0x0000000000000000-mapping.dmp

Download
memory/1228-54-0x0000000000FC0000-0x000000000106E000-memory.dmp

Filesize
696KB

Download