5293f22b4ceca93d14fd18c1efcb62a47c4b4649c6e796fda7d1024fc9fd71e0

Analysis

max time kernel
53s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 15:06

Target

5293f22b4ceca93d14fd18c1efcb62a47c4b4649c6e796fda7d1024fc9fd71e0.exe
Size

66KB
MD5

e67c4c57b903156ab1c07d7394617de0
SHA1

5f34074d5207e1e50af160ddfbe8e464628f50a2
SHA256

5293f22b4ceca93d14fd18c1efcb62a47c4b4649c6e796fda7d1024fc9fd71e0
SHA512

af1bab584efebbb1c6eb394a95d32f04a56b9d918147e806333197faf0407abaac83b0364ee5c3e2a064cf827ca98efaa6f44275acc5bae24febb706cbac14ee
SSDEEP

1536:0n6fdqpdmJ/oMi2aqXQK3XDpzjpKxcCjM0BHp//07ho9+Nuaz:S6fdO+Ad2zJ3TpzVKuCjfBHp34ho4Nu+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1396	1916	WerFault.exe	20

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 1396	1916	5293f22b4ceca93d14fd18c1efcb62a47c4b4649c6e796fda7d1024fc9fd71e0.exe	28
PID 1916 wrote to memory of 1396	1916	5293f22b4ceca93d14fd18c1efcb62a47c4b4649c6e796fda7d1024fc9fd71e0.exe	28
PID 1916 wrote to memory of 1396	1916	5293f22b4ceca93d14fd18c1efcb62a47c4b4649c6e796fda7d1024fc9fd71e0.exe	28
PID 1916 wrote to memory of 1396	1916	5293f22b4ceca93d14fd18c1efcb62a47c4b4649c6e796fda7d1024fc9fd71e0.exe	28

C:\Users\Admin\AppData\Local\Temp\5293f22b4ceca93d14fd18c1efcb62a47c4b4649c6e796fda7d1024fc9fd71e0.exe
"C:\Users\Admin\AppData\Local\Temp\5293f22b4ceca93d14fd18c1efcb62a47c4b4649c6e796fda7d1024fc9fd71e0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 36
  2⤵
  - Program crash
  PID:1396

memory/1916-54-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download