96f5c0e73222f2baa7c4be7ee2f8bdab3fffb46fb9ebe509664ee92d53888545

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 22:52

Target

96f5c0e73222f2baa7c4be7ee2f8bdab3fffb46fb9ebe509664ee92d53888545.exe
Size

175KB
MD5

5f407e1a83b8da3c462e0c2a9a22dfbb
SHA1

897e8801a0ea474cd8ecb60359b38d478491444c
SHA256

96f5c0e73222f2baa7c4be7ee2f8bdab3fffb46fb9ebe509664ee92d53888545
SHA512

c85317ca49c032bd95827dfe127ad4d84a491b4e546cabedc770e86d342cc55890c9787802d9bd9008feb7aafb68377134cc8e498217dcf7b9003633d15813db
SSDEEP

1536:+iU3DoKtniY1u7Nn2JFkC2styJjCKICFjC7EWisS+5jlatSfkZQui:+iSDzK71QkbstyJjCKICpC72s/jlaXy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1472	112	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 112 wrote to memory of 1472	112	96f5c0e73222f2baa7c4be7ee2f8bdab3fffb46fb9ebe509664ee92d53888545.exe	27
PID 112 wrote to memory of 1472	112	96f5c0e73222f2baa7c4be7ee2f8bdab3fffb46fb9ebe509664ee92d53888545.exe	27
PID 112 wrote to memory of 1472	112	96f5c0e73222f2baa7c4be7ee2f8bdab3fffb46fb9ebe509664ee92d53888545.exe	27
PID 112 wrote to memory of 1472	112	96f5c0e73222f2baa7c4be7ee2f8bdab3fffb46fb9ebe509664ee92d53888545.exe	27

C:\Users\Admin\AppData\Local\Temp\96f5c0e73222f2baa7c4be7ee2f8bdab3fffb46fb9ebe509664ee92d53888545.exe
"C:\Users\Admin\AppData\Local\Temp\96f5c0e73222f2baa7c4be7ee2f8bdab3fffb46fb9ebe509664ee92d53888545.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 112 -s 128
  2⤵
  - Program crash
  PID:1472

memory/112-55-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download