5aad532271b4266719da784175d7c090bb5dcb1353f2f1360c5cc3304b35b958

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
21-12-2022 19:15

Target

5aad532271b4266719da784175d7c090bb5dcb1353f2f1360c5cc3304b35b958.exe
Size

49KB
MD5

ed141b057f508e298f41a49f95739ae2
SHA1

746407357e1a2c5eddc6ecb71a5009131bdc5957
SHA256

5aad532271b4266719da784175d7c090bb5dcb1353f2f1360c5cc3304b35b958
SHA512

24f8dfbfb4277da7e895f022923e37a86e65f4600331829606a877e01be138823609c25722da9dc107d46446f53be71b54013b30739e9dd7efe16afe76da9fa2
SSDEEP

1536:SkVouOe6Q36FqDLJCnY+Gs2IMrv5PwF5w:BVZ5KCLJCL2Sn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1788	2044	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1788	2044	5aad532271b4266719da784175d7c090bb5dcb1353f2f1360c5cc3304b35b958.exe	29
PID 2044 wrote to memory of 1788	2044	5aad532271b4266719da784175d7c090bb5dcb1353f2f1360c5cc3304b35b958.exe	29
PID 2044 wrote to memory of 1788	2044	5aad532271b4266719da784175d7c090bb5dcb1353f2f1360c5cc3304b35b958.exe	29
PID 2044 wrote to memory of 1788	2044	5aad532271b4266719da784175d7c090bb5dcb1353f2f1360c5cc3304b35b958.exe	29

C:\Users\Admin\AppData\Local\Temp\5aad532271b4266719da784175d7c090bb5dcb1353f2f1360c5cc3304b35b958.exe
"C:\Users\Admin\AppData\Local\Temp\5aad532271b4266719da784175d7c090bb5dcb1353f2f1360c5cc3304b35b958.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 204
  2⤵
  - Program crash
  PID:1788

memory/2044-54-0x00000000767F1000-0x00000000767F3000-memory.dmp

Filesize
8KB

Download