a5d5fc29da622179261ecbcc183f254b981543d52db9cf699e382997f0d9dac6

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 12:02

Target

a5d5fc29da622179261ecbcc183f254b981543d52db9cf699e382997f0d9dac6.exe
Size

691KB
MD5

bc26914736055bf78a79959be480c222
SHA1

1c1137fce825a571b04c1265e91c18dc185dc71f
SHA256

a5d5fc29da622179261ecbcc183f254b981543d52db9cf699e382997f0d9dac6
SHA512

8acd72aedf65787e67c7a12c2e1d462fdf1f3b5f026051e0831b2778c6e5a274f3f9ca4b34efd1569db8dfa9dea3b470a85e00f7a5af96267e8ea29766c09358
SSDEEP

12288:vk8UbPJHJMiy4IadS4ms5I6e66fEheKhGDvkve:ObJJbSaE4mvt/nDvkve

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

888 1528 WerFault.exe a5d5fc29da622179261ecbcc183f254b981543d52db9cf699e382997f0d9dac6.exe

pid	pid_target	process	target process
888	1528	WerFault.exe	a5d5fc29da622179261ecbcc183f254b981543d52db9cf699e382997f0d9dac6.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

a5d5fc29da622179261ecbcc183f254b981543d52db9cf699e382997f0d9dac6.exe

description	pid	process	target process
PID 1528 wrote to memory of 888	1528	a5d5fc29da622179261ecbcc183f254b981543d52db9cf699e382997f0d9dac6.exe	WerFault.exe
PID 1528 wrote to memory of 888	1528	a5d5fc29da622179261ecbcc183f254b981543d52db9cf699e382997f0d9dac6.exe	WerFault.exe
PID 1528 wrote to memory of 888	1528	a5d5fc29da622179261ecbcc183f254b981543d52db9cf699e382997f0d9dac6.exe	WerFault.exe
PID 1528 wrote to memory of 888	1528	a5d5fc29da622179261ecbcc183f254b981543d52db9cf699e382997f0d9dac6.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\a5d5fc29da622179261ecbcc183f254b981543d52db9cf699e382997f0d9dac6.exe
"C:\Users\Admin\AppData\Local\Temp\a5d5fc29da622179261ecbcc183f254b981543d52db9cf699e382997f0d9dac6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 572
2⤵
- Program crash
PID:888

memory/888-55-0x0000000000000000-mapping.dmp

Download
memory/1528-54-0x0000000000C30000-0x0000000000CE4000-memory.dmp

Filesize
720KB

Download