5e6be34485a633477de601569187d59a1d958fe00b71fa5b256520b4aa23a323

Analysis

max time kernel
84s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 00:12

Target

5e6be34485a633477de601569187d59a1d958fe00b71fa5b256520b4aa23a323.exe
Size

88KB
MD5

1b86cad7ec885b104146f088a69511c0
SHA1

ea1f8ef4e1358d4ef004c9e0449b793319c0d5a4
SHA256

5e6be34485a633477de601569187d59a1d958fe00b71fa5b256520b4aa23a323
SHA512

3702a923aaeb4dda0bff7a73307210d672b5c041578a2deb289872fe738cab5dc14e63d2e030aec499cfe3a0c84cac6f1fcee2b30f3d8f7ef2e3992050fa5bcf
SSDEEP

1536:xsg0CaAHtQZzDekx+i2jAAt/QMJxVWKq9:aAHtQZzDnx+i2jdTq9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1632	836	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 1632	836	5e6be34485a633477de601569187d59a1d958fe00b71fa5b256520b4aa23a323.exe	28
PID 836 wrote to memory of 1632	836	5e6be34485a633477de601569187d59a1d958fe00b71fa5b256520b4aa23a323.exe	28
PID 836 wrote to memory of 1632	836	5e6be34485a633477de601569187d59a1d958fe00b71fa5b256520b4aa23a323.exe	28
PID 836 wrote to memory of 1632	836	5e6be34485a633477de601569187d59a1d958fe00b71fa5b256520b4aa23a323.exe	28

C:\Users\Admin\AppData\Local\Temp\5e6be34485a633477de601569187d59a1d958fe00b71fa5b256520b4aa23a323.exe
"C:\Users\Admin\AppData\Local\Temp\5e6be34485a633477de601569187d59a1d958fe00b71fa5b256520b4aa23a323.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 88
  2⤵
  - Program crash
  PID:1632

memory/836-55-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download