5d9c2ee33c46151d44665d21f226f7c881e5bdfc60138c112043db91dd58ea93

Analysis

max time kernel
2s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 01:25

Target

5d9c2ee33c46151d44665d21f226f7c881e5bdfc60138c112043db91dd58ea93.exe
Size

18KB
MD5

1ce0d30a5aa1557a36224f06d09beec0
SHA1

48ff762c85cb8fc9a1cfbcd301470f84aecd0811
SHA256

5d9c2ee33c46151d44665d21f226f7c881e5bdfc60138c112043db91dd58ea93
SHA512

c106f818d50404853d01475b96a463f7f17e43b402a7c9b70e65a7d8049e3a44872adf4acc11830a9ad33d638c746f6943c1f75e7a68fc94d5e2513e98ffe52b
SSDEEP

384:16oHdNa954PP8V7fClUmu2LEoobpSQzURKqw:ICrP8V7kUmuCdQf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1596	1624	WerFault.exe	27

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 1596	1624	5d9c2ee33c46151d44665d21f226f7c881e5bdfc60138c112043db91dd58ea93.exe	28
PID 1624 wrote to memory of 1596	1624	5d9c2ee33c46151d44665d21f226f7c881e5bdfc60138c112043db91dd58ea93.exe	28
PID 1624 wrote to memory of 1596	1624	5d9c2ee33c46151d44665d21f226f7c881e5bdfc60138c112043db91dd58ea93.exe	28
PID 1624 wrote to memory of 1596	1624	5d9c2ee33c46151d44665d21f226f7c881e5bdfc60138c112043db91dd58ea93.exe	28
PID 1624 wrote to memory of 1596	1624	5d9c2ee33c46151d44665d21f226f7c881e5bdfc60138c112043db91dd58ea93.exe	28
PID 1624 wrote to memory of 1596	1624	5d9c2ee33c46151d44665d21f226f7c881e5bdfc60138c112043db91dd58ea93.exe	28
PID 1624 wrote to memory of 1596	1624	5d9c2ee33c46151d44665d21f226f7c881e5bdfc60138c112043db91dd58ea93.exe	28

C:\Users\Admin\AppData\Local\Temp\5d9c2ee33c46151d44665d21f226f7c881e5bdfc60138c112043db91dd58ea93.exe
"C:\Users\Admin\AppData\Local\Temp\5d9c2ee33c46151d44665d21f226f7c881e5bdfc60138c112043db91dd58ea93.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 256
  2⤵
  - Program crash
  PID:1596

memory/1624-54-0x00000000767D1000-0x00000000767D3000-memory.dmp

Filesize
8KB

Download