b5c9a477317b1ece011aad7f39db2e82bf71f790fcdb32c87e32508d1841ee06

Analysis

max time kernel
26s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 08:12

Target

b5c9a477317b1ece011aad7f39db2e82bf71f790fcdb32c87e32508d1841ee06.exe
Size

494KB
MD5

4a9cd2a20b53d9480a377ec1a22ecb1f
SHA1

95e17f9d7aa9112abbbf2bd8cbd21fd897ce6267
SHA256

b5c9a477317b1ece011aad7f39db2e82bf71f790fcdb32c87e32508d1841ee06
SHA512

db3dbe4a0102e41e26e7e17ec75d8d4214e83b7bd929d3286f867512a330d34b386c69613cc14da5a30959707a603b49755f447f55416bb3c62225a92670e3c6
SSDEEP

12288:CBIkCzgKXkYrby+fqi2yqcUMOyBlgNtTirdorWB:CAzjkYrbolyqcR4TEdo8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1976	1480	WerFault.exe	21

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 1976	1480	b5c9a477317b1ece011aad7f39db2e82bf71f790fcdb32c87e32508d1841ee06.exe	27
PID 1480 wrote to memory of 1976	1480	b5c9a477317b1ece011aad7f39db2e82bf71f790fcdb32c87e32508d1841ee06.exe	27
PID 1480 wrote to memory of 1976	1480	b5c9a477317b1ece011aad7f39db2e82bf71f790fcdb32c87e32508d1841ee06.exe	27
PID 1480 wrote to memory of 1976	1480	b5c9a477317b1ece011aad7f39db2e82bf71f790fcdb32c87e32508d1841ee06.exe	27

C:\Users\Admin\AppData\Local\Temp\b5c9a477317b1ece011aad7f39db2e82bf71f790fcdb32c87e32508d1841ee06.exe
"C:\Users\Admin\AppData\Local\Temp\b5c9a477317b1ece011aad7f39db2e82bf71f790fcdb32c87e32508d1841ee06.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 204
  2⤵
  - Program crash
  PID:1976

memory/1480-54-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download
memory/1480-55-0x0000000000400000-0x00000000004F4200-memory.dmp

Filesize
976KB

Download
memory/1480-57-0x0000000000400000-0x00000000004F4200-memory.dmp

Filesize
976KB

Download