5fb47ce5f59dbc06542807e8ed6f9d8974e0340d1da78218a68cf8600f26f785

Analysis

max time kernel
1s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 23:28

Target

5fb47ce5f59dbc06542807e8ed6f9d8974e0340d1da78218a68cf8600f26f785.exe
Size

182KB
MD5

c45ed22a6d1ea4e36385f500fd64e2b4
SHA1

18f79c3a1d686e0ea8de8d685de7769872d8f6a6
SHA256

5fb47ce5f59dbc06542807e8ed6f9d8974e0340d1da78218a68cf8600f26f785
SHA512

8ce8f7260480606ba89a096fa9c6d09746e99084a1ffa6ee178a5ac3a8afdaf4e0ee22de75a0625f17a3b546abe08790e8333cb09702226be216b45aa6ce3f78
SSDEEP

3072:7G8bumjRuYsFOslRj0nKzkX3Brj1z2PfNSn0uXy7vNnkssVuCrvOCxh:K8am5sFZj0KgnBX1yPla0RvNkz0C/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1172	1812	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 1172	1812	5fb47ce5f59dbc06542807e8ed6f9d8974e0340d1da78218a68cf8600f26f785.exe	28
PID 1812 wrote to memory of 1172	1812	5fb47ce5f59dbc06542807e8ed6f9d8974e0340d1da78218a68cf8600f26f785.exe	28
PID 1812 wrote to memory of 1172	1812	5fb47ce5f59dbc06542807e8ed6f9d8974e0340d1da78218a68cf8600f26f785.exe	28
PID 1812 wrote to memory of 1172	1812	5fb47ce5f59dbc06542807e8ed6f9d8974e0340d1da78218a68cf8600f26f785.exe	28

C:\Users\Admin\AppData\Local\Temp\5fb47ce5f59dbc06542807e8ed6f9d8974e0340d1da78218a68cf8600f26f785.exe
"C:\Users\Admin\AppData\Local\Temp\5fb47ce5f59dbc06542807e8ed6f9d8974e0340d1da78218a68cf8600f26f785.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 156
  2⤵
  - Program crash
  PID:1172

memory/1812-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download