faf6943211190f86e38fad307c55717e2502871e459a7b2ebbab03a577601885

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19/07/2023, 09:58

Target

PI-EP 05919.exe
Size

559KB
MD5

103264e1af3afccc182abbb66ff64bb5
SHA1

96765da528bc4bc406894dc020adafd080e04af0
SHA256

95934ccfa95253459a4caa462ebcb4435c27ef7ce1d3a7aa4c8d6ddea9806938
SHA512

87541ea2c33d08f75a33e1cc9c667b8eb64a5b4ada65b7490f53f60dba08e5606281093bf58d283bd48bdd55ae0cbecd40bb16dff9f3ad2ba6a5188213b8c68c
SSDEEP

12288:tPYPfY7fpf88MbfL5wiE4UYLXb57GdWacRmg8D4jd:tPYPglfabz5wiMkGEpx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2516	1036	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 2516	1036	PI-EP 05919.exe	30
PID 1036 wrote to memory of 2516	1036	PI-EP 05919.exe	30
PID 1036 wrote to memory of 2516	1036	PI-EP 05919.exe	30
PID 1036 wrote to memory of 2516	1036	PI-EP 05919.exe	30

C:\Users\Admin\AppData\Local\Temp\PI-EP 05919.exe
"C:\Users\Admin\AppData\Local\Temp\PI-EP 05919.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1036 -s 668
  2⤵
  - Program crash
  PID:2516

memory/1036-53-0x00000000745F0000-0x0000000074CDE000-memory.dmp

Filesize
6.9MB

Download
memory/1036-54-0x0000000000090000-0x0000000000122000-memory.dmp

Filesize
584KB

Download
memory/1036-55-0x0000000004D00000-0x0000000004D40000-memory.dmp

Filesize
256KB

Download
memory/1036-56-0x00000000003D0000-0x00000000003DE000-memory.dmp

Filesize
56KB

Download
memory/1036-57-0x00000000745F0000-0x0000000074CDE000-memory.dmp

Filesize
6.9MB

Download
memory/1036-58-0x0000000004D00000-0x0000000004D40000-memory.dmp

Filesize
256KB

Download
memory/1036-59-0x0000000000540000-0x000000000054A000-memory.dmp

Filesize
40KB

Download