b5f9f13d9ae388c5ba0aaa117583f6414137227a7e5c46c494c0f81aa9399185

Analysis

max time kernel
44s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 17:33

Target

b5f9f13d9ae388c5ba0aaa117583f6414137227a7e5c46c494c0f81aa9399185.exe
Size

679KB
MD5

c44c31c7fdfbddb3441700ce6d982335
SHA1

0a7e58b45c258045c8f4de5a733686ed4ebe82df
SHA256

b5f9f13d9ae388c5ba0aaa117583f6414137227a7e5c46c494c0f81aa9399185
SHA512

449efe46e4dda6ccf9a8795fa92ce293b6994445fa8f9671d9c6ff866d24b007c9d184d1e351a4fffc0f8cb62e47b645a98aaf5b830d4bc54f0a7c03b068fd59
SSDEEP

12288:LaYaYezb54OpTFssvWnmuUXqMJ4mlngaDs4aUwxbmZWfoBnjto6UG9hE:paYeqO7dO0Xq24ss4dwbmZWsFFq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1124	1492	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1124	1492	b5f9f13d9ae388c5ba0aaa117583f6414137227a7e5c46c494c0f81aa9399185.exe	27
PID 1492 wrote to memory of 1124	1492	b5f9f13d9ae388c5ba0aaa117583f6414137227a7e5c46c494c0f81aa9399185.exe	27
PID 1492 wrote to memory of 1124	1492	b5f9f13d9ae388c5ba0aaa117583f6414137227a7e5c46c494c0f81aa9399185.exe	27
PID 1492 wrote to memory of 1124	1492	b5f9f13d9ae388c5ba0aaa117583f6414137227a7e5c46c494c0f81aa9399185.exe	27

C:\Users\Admin\AppData\Local\Temp\b5f9f13d9ae388c5ba0aaa117583f6414137227a7e5c46c494c0f81aa9399185.exe
"C:\Users\Admin\AppData\Local\Temp\b5f9f13d9ae388c5ba0aaa117583f6414137227a7e5c46c494c0f81aa9399185.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 36
  2⤵
  - Program crash
  PID:1124

memory/1492-55-0x0000000000400000-0x000000000051A600-memory.dmp

Filesize
1.1MB

Download