5f6c7f5c30e19b02547667e6977b67cdd6944963dcb2803743d00a67f59c07b8

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
18/12/2022, 04:46

Target

5f6c7f5c30e19b02547667e6977b67cdd6944963dcb2803743d00a67f59c07b8.exe
Size

88KB
MD5

a13c5f9783cfa2fe9f7e79d58c7e7f91
SHA1

8ceec74ccb7290c88ed3abc247950c4ab8f11f99
SHA256

5f6c7f5c30e19b02547667e6977b67cdd6944963dcb2803743d00a67f59c07b8
SHA512

ae2ef8f07cc3f31df7c203b83cd378739865ffbd258449614ed546a39b3e09ea56beb4c9bab0eaa47f986f79f507249c6ff7c43078687d0b5b7c1f3624e97bd5
SSDEEP

1536:NOZhKNuBNiabLwL1RntaQMPtAkGupTROEs7X/:YZoBtaQKd1RODX/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1280	1748	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 1280	1748	5f6c7f5c30e19b02547667e6977b67cdd6944963dcb2803743d00a67f59c07b8.exe	28
PID 1748 wrote to memory of 1280	1748	5f6c7f5c30e19b02547667e6977b67cdd6944963dcb2803743d00a67f59c07b8.exe	28
PID 1748 wrote to memory of 1280	1748	5f6c7f5c30e19b02547667e6977b67cdd6944963dcb2803743d00a67f59c07b8.exe	28
PID 1748 wrote to memory of 1280	1748	5f6c7f5c30e19b02547667e6977b67cdd6944963dcb2803743d00a67f59c07b8.exe	28

C:\Users\Admin\AppData\Local\Temp\5f6c7f5c30e19b02547667e6977b67cdd6944963dcb2803743d00a67f59c07b8.exe
"C:\Users\Admin\AppData\Local\Temp\5f6c7f5c30e19b02547667e6977b67cdd6944963dcb2803743d00a67f59c07b8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 96
  2⤵
  - Program crash
  PID:1280