a5538d8e2b651ff2088e5ecac48c9a050c1256820da22c2abcbf44984e18aab0

Analysis

max time kernel
151s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
02/05/2023, 22:11

Target

a5538d8e2b651ff2088e5ecac48c9a050c1256820da22c2abcbf44984e18aab0.exe
Size

5.4MB
MD5

5bcfe0a3fe831ce8cf21242486fb2557
SHA1

595203706b524f6daaa8095e44221bda52cd06aa
SHA256

a5538d8e2b651ff2088e5ecac48c9a050c1256820da22c2abcbf44984e18aab0
SHA512

7d133a8901cd20dad48af90ebd64156b3fb9d9271243176301ce6abb9c757bab2076a99453f3f36db12b4c3bcda94d925407dd9578b1a2f9df4d04c9d23ced86
SSDEEP

98304:UrNepRBlKt1C3FVwrEyflo1TNqRQI3PqSXIGr9EAxIUiAU5SWiZ7f3P7xMIt8KnG:eNerBw7C3FVwYytM2p3PqaIUEA/iAYC8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1056	1764	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 1056	1764	a5538d8e2b651ff2088e5ecac48c9a050c1256820da22c2abcbf44984e18aab0.exe	28
PID 1764 wrote to memory of 1056	1764	a5538d8e2b651ff2088e5ecac48c9a050c1256820da22c2abcbf44984e18aab0.exe	28
PID 1764 wrote to memory of 1056	1764	a5538d8e2b651ff2088e5ecac48c9a050c1256820da22c2abcbf44984e18aab0.exe	28
PID 1764 wrote to memory of 1056	1764	a5538d8e2b651ff2088e5ecac48c9a050c1256820da22c2abcbf44984e18aab0.exe	28

C:\Users\Admin\AppData\Local\Temp\a5538d8e2b651ff2088e5ecac48c9a050c1256820da22c2abcbf44984e18aab0.exe
"C:\Users\Admin\AppData\Local\Temp\a5538d8e2b651ff2088e5ecac48c9a050c1256820da22c2abcbf44984e18aab0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 164
  2⤵
  - Program crash
  PID:1056

memory/1764-54-0x0000000000350000-0x0000000000FFF000-memory.dmp

Filesize
12.7MB

Download