5b25f5c707386a572c496b5b3eb0fcbf8829b8bf11cec0caeda66ee7ad01a640

Analysis

max time kernel
35s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:13

Target

5b25f5c707386a572c496b5b3eb0fcbf8829b8bf11cec0caeda66ee7ad01a640.exe
Size

63KB
MD5

45719d29d45b105b7e7039aa8583d321
SHA1

ad010ac4be747184f67153ec6b3bb474a0f52b2f
SHA256

5b25f5c707386a572c496b5b3eb0fcbf8829b8bf11cec0caeda66ee7ad01a640
SHA512

38e782f28f5dd51f4c751335f0fa2387cd2ebe299b2effb29861c475c4d518b4875177db7010981da2af4de1162f7f5425374eb29d2f5ccb8654ae668130409e
SSDEEP

768:o06R0UEgnKqGR7//GPc0LOBhvBrHks3IiyhDYQbGmxlNaM+WGa1wuxnzgOYw9IC9:mR0In3Pc0LCH9MtbvabUDzJYWu3BU

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1952 1592 WerFault.exe 5b25f5c707386a572c496b5b3eb0fcbf8829b8bf11cec0caeda66ee7ad01a640.exe

pid	pid_target	process	target process
1952	1592	WerFault.exe	5b25f5c707386a572c496b5b3eb0fcbf8829b8bf11cec0caeda66ee7ad01a640.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5b25f5c707386a572c496b5b3eb0fcbf8829b8bf11cec0caeda66ee7ad01a640.exe

description	pid	process	target process
PID 1592 wrote to memory of 1952	1592	5b25f5c707386a572c496b5b3eb0fcbf8829b8bf11cec0caeda66ee7ad01a640.exe	WerFault.exe
PID 1592 wrote to memory of 1952	1592	5b25f5c707386a572c496b5b3eb0fcbf8829b8bf11cec0caeda66ee7ad01a640.exe	WerFault.exe
PID 1592 wrote to memory of 1952	1592	5b25f5c707386a572c496b5b3eb0fcbf8829b8bf11cec0caeda66ee7ad01a640.exe	WerFault.exe
PID 1592 wrote to memory of 1952	1592	5b25f5c707386a572c496b5b3eb0fcbf8829b8bf11cec0caeda66ee7ad01a640.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\5b25f5c707386a572c496b5b3eb0fcbf8829b8bf11cec0caeda66ee7ad01a640.exe
"C:\Users\Admin\AppData\Local\Temp\5b25f5c707386a572c496b5b3eb0fcbf8829b8bf11cec0caeda66ee7ad01a640.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 156
2⤵
- Program crash
PID:1952

memory/1592-54-0x0000000074FB1000-0x0000000074FB3000-memory.dmp

Filesize
8KB

Download
memory/1952-55-0x0000000000000000-mapping.dmp

Download