e5946c17089fcb14451ba3693e11c269bcdaab7c1e5f0522566ae6dbb94c9cab

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 07:04

Target

5b5c82a116ab09bb5e4628b653cab2bf.exe
Size

156KB
MD5

5b5c82a116ab09bb5e4628b653cab2bf
SHA1

891871555faf52e06c2ec2cc2d146068344da615
SHA256

e5946c17089fcb14451ba3693e11c269bcdaab7c1e5f0522566ae6dbb94c9cab
SHA512

d6ea8c1248d48105a4f574be5f967652d61703439cd0c2749668a59385df87a7fab089415d816805c2ecacd9fd2af49ab56d73fe53f5e157cb53dfd51fb297aa
SSDEEP

1536:bOoCUEwoD8U5ltipp2VkMnGcf0lDAopNvdNtpb2H7siSPMG:bOoKjIU1IpEHnGcf0l80SH+F

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2760	2848	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2760	2848	5b5c82a116ab09bb5e4628b653cab2bf.exe	28
PID 2848 wrote to memory of 2760	2848	5b5c82a116ab09bb5e4628b653cab2bf.exe	28
PID 2848 wrote to memory of 2760	2848	5b5c82a116ab09bb5e4628b653cab2bf.exe	28
PID 2848 wrote to memory of 2760	2848	5b5c82a116ab09bb5e4628b653cab2bf.exe	28

C:\Users\Admin\AppData\Local\Temp\5b5c82a116ab09bb5e4628b653cab2bf.exe
"C:\Users\Admin\AppData\Local\Temp\5b5c82a116ab09bb5e4628b653cab2bf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 36
  2⤵
  - Program crash
  PID:2760

memory/2848-0-0x0000000000400000-0x0000000000427200-memory.dmp

Filesize
156KB

Download