5fb97e2b9b7b5bc403649de9cc9800db501e55f6a7f66ea94260012474e6fd4f

Analysis

max time kernel
28s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 08:11

Target

5fb97e2b9b7b5bc403649de9cc9800db501e55f6a7f66ea94260012474e6fd4f.exe
Size

32KB
MD5

93c385db9cbcf10a4a1da7c5d3f56bc4
SHA1

74bb88f992e8ffa754e35defce45062edfe30cf5
SHA256

5fb97e2b9b7b5bc403649de9cc9800db501e55f6a7f66ea94260012474e6fd4f
SHA512

43833d6969c197875b94c3dd3021c31a2f3f6ce90902b91e76f0aa5a67bc27c5b327a74f16d4219d00dc0319ed51eeb2f60981e668d9b998d8b4d060e98223db
SSDEEP

384:Ll6ENbnF3SohnnLQ470tocHuxRNCg6qyUsR+:cERFCohLQ4VcOxRNCg6FUs

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1672	360	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 360 wrote to memory of 1672	360	5fb97e2b9b7b5bc403649de9cc9800db501e55f6a7f66ea94260012474e6fd4f.exe	28
PID 360 wrote to memory of 1672	360	5fb97e2b9b7b5bc403649de9cc9800db501e55f6a7f66ea94260012474e6fd4f.exe	28
PID 360 wrote to memory of 1672	360	5fb97e2b9b7b5bc403649de9cc9800db501e55f6a7f66ea94260012474e6fd4f.exe	28
PID 360 wrote to memory of 1672	360	5fb97e2b9b7b5bc403649de9cc9800db501e55f6a7f66ea94260012474e6fd4f.exe	28

C:\Users\Admin\AppData\Local\Temp\5fb97e2b9b7b5bc403649de9cc9800db501e55f6a7f66ea94260012474e6fd4f.exe
"C:\Users\Admin\AppData\Local\Temp\5fb97e2b9b7b5bc403649de9cc9800db501e55f6a7f66ea94260012474e6fd4f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:360
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 360 -s 88
  2⤵
  - Program crash
  PID:1672

memory/360-55-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download