5ff1b0751e096fc76d57b018ceaa9d73b679a09937d29dcfab6955c55a6cb1f2

Analysis

max time kernel
119s
max time network
134s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 23:09

Target

5ff1b0751e096fc76d57b018ceaa9d73b679a09937d29dcfab6955c55a6cb1f2.exe
Size

456KB
MD5

3349b9d62225edfbfc3f45a772defd70
SHA1

15efaa816d522e864e5977657159f8dd1674f24e
SHA256

5ff1b0751e096fc76d57b018ceaa9d73b679a09937d29dcfab6955c55a6cb1f2
SHA512

5089c557f7d15df9ed21d106aa3700b98d4ec8544d1e4317e56f33ffa90b31ecca558f6a326c7ab1828f4e4d859a5a39165c46b5a527c71949d4d1fd60fe2c61
SSDEEP

12288:1AbmEf58v6/KestdGZXByT9C2hEAx9vsX9rWtH:1xEfZdUdGZxyZCsLs1WtH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2552	3020	WerFault.exe	22

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2552	3020	5ff1b0751e096fc76d57b018ceaa9d73b679a09937d29dcfab6955c55a6cb1f2.exe	28
PID 3020 wrote to memory of 2552	3020	5ff1b0751e096fc76d57b018ceaa9d73b679a09937d29dcfab6955c55a6cb1f2.exe	28
PID 3020 wrote to memory of 2552	3020	5ff1b0751e096fc76d57b018ceaa9d73b679a09937d29dcfab6955c55a6cb1f2.exe	28
PID 3020 wrote to memory of 2552	3020	5ff1b0751e096fc76d57b018ceaa9d73b679a09937d29dcfab6955c55a6cb1f2.exe	28

C:\Users\Admin\AppData\Local\Temp\5ff1b0751e096fc76d57b018ceaa9d73b679a09937d29dcfab6955c55a6cb1f2.exe
"C:\Users\Admin\AppData\Local\Temp\5ff1b0751e096fc76d57b018ceaa9d73b679a09937d29dcfab6955c55a6cb1f2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 96
  2⤵
  - Program crash
  PID:2552