c5b7bb069cc68c5aeec45af6764d0bd0a3512bcfac67413a95c09468f64e8917

Analysis

max time kernel
39s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 06:25

Target

c5b7bb069cc68c5aeec45af6764d0bd0a3512bcfac67413a95c09468f64e8917.exe
Size

36KB
MD5

df8364eb08f45964c934c8630b29f54f
SHA1

aa3eff4b40e3103a153c2cd564cf7b8c493c2a91
SHA256

c5b7bb069cc68c5aeec45af6764d0bd0a3512bcfac67413a95c09468f64e8917
SHA512

7204b24cdf60c82f222193da82e7a69808eb7b3e1aa1006f0256f58af1ed04cf5d105bef619694ce7f1d50e82d06fcef06edd50351ccc35e9e6e91de551ff283
SSDEEP

768:UQglqVVgz7aSPReR/ZC95/mE2CGWqhZQkAxdHGHd8cBUOpDB4W533EGV/Ab:UQgqEz7pp2RC95/YlLQkqmZvpOW5nFYb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
484	1224	WerFault.exe	27

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 2028	1224	c5b7bb069cc68c5aeec45af6764d0bd0a3512bcfac67413a95c09468f64e8917.exe	28
PID 1224 wrote to memory of 2028	1224	c5b7bb069cc68c5aeec45af6764d0bd0a3512bcfac67413a95c09468f64e8917.exe	28
PID 1224 wrote to memory of 2028	1224	c5b7bb069cc68c5aeec45af6764d0bd0a3512bcfac67413a95c09468f64e8917.exe	28
PID 1224 wrote to memory of 2028	1224	c5b7bb069cc68c5aeec45af6764d0bd0a3512bcfac67413a95c09468f64e8917.exe	28
PID 1224 wrote to memory of 484	1224	c5b7bb069cc68c5aeec45af6764d0bd0a3512bcfac67413a95c09468f64e8917.exe	29
PID 1224 wrote to memory of 484	1224	c5b7bb069cc68c5aeec45af6764d0bd0a3512bcfac67413a95c09468f64e8917.exe	29
PID 1224 wrote to memory of 484	1224	c5b7bb069cc68c5aeec45af6764d0bd0a3512bcfac67413a95c09468f64e8917.exe	29
PID 1224 wrote to memory of 484	1224	c5b7bb069cc68c5aeec45af6764d0bd0a3512bcfac67413a95c09468f64e8917.exe	29

C:\Users\Admin\AppData\Local\Temp\c5b7bb069cc68c5aeec45af6764d0bd0a3512bcfac67413a95c09468f64e8917.exe
"C:\Users\Admin\AppData\Local\Temp\c5b7bb069cc68c5aeec45af6764d0bd0a3512bcfac67413a95c09468f64e8917.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Users\Admin\AppData\Local\Temp\c5b7bb069cc68c5aeec45af6764d0bd0a3512bcfac67413a95c09468f64e8917.exe
  C:\Users\Admin\AppData\Local\Temp\c5b7bb069cc68c5aeec45af6764d0bd0a3512bcfac67413a95c09468f64e8917.exe
  2⤵
  PID:2028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 56
  2⤵
  - Program crash
  PID:484