5589a8c1e5499ab66ea90c8ed6f0c5907bc588e7dbc9c45efd842f33df2c188b

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
10/06/2023, 01:21

Target

fb2f32a74864309c7fa49bc5ded04863f3d9b72a1f907675a7ab8d2bb2bb081d.exe
Size

304KB
MD5

4c2f4a87b5e76448b48b99ed4efcecb8
SHA1

e59520de239843680cd30727cda0e43074dcc5ae
SHA256

fb2f32a74864309c7fa49bc5ded04863f3d9b72a1f907675a7ab8d2bb2bb081d
SHA512

665e186a540208a95488a2e56f59b6f105addb59fd404e9ccef4373e04b3b2e87bac3ff9b350d48c150ae54e41f68e3462747f1ebfa1e9a8f8083376b26e9cda
SSDEEP

6144:uAXv4YWuKqNUAdpECKlRUuZxnbJRHIHfqooOX/w2W:jQYFF6gECKlRHJ+AOX/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1484	624	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 1484	624	fb2f32a74864309c7fa49bc5ded04863f3d9b72a1f907675a7ab8d2bb2bb081d.exe	28
PID 624 wrote to memory of 1484	624	fb2f32a74864309c7fa49bc5ded04863f3d9b72a1f907675a7ab8d2bb2bb081d.exe	28
PID 624 wrote to memory of 1484	624	fb2f32a74864309c7fa49bc5ded04863f3d9b72a1f907675a7ab8d2bb2bb081d.exe	28
PID 624 wrote to memory of 1484	624	fb2f32a74864309c7fa49bc5ded04863f3d9b72a1f907675a7ab8d2bb2bb081d.exe	28

C:\Users\Admin\AppData\Local\Temp\fb2f32a74864309c7fa49bc5ded04863f3d9b72a1f907675a7ab8d2bb2bb081d.exe
"C:\Users\Admin\AppData\Local\Temp\fb2f32a74864309c7fa49bc5ded04863f3d9b72a1f907675a7ab8d2bb2bb081d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 36
  2⤵
  - Program crash
  PID:1484