a5f341173a288b07f6f6725bf77255c9ed011606856e31cd4385f753023fe6d3

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 02:39

Target

a5f341173a288b07f6f6725bf77255c9ed011606856e31cd4385f753023fe6d3.exe
Size

2.5MB
MD5

c29e8581b10963ba6b4944967caa1a7a
SHA1

e423ca08256f18b6b43fc5a642ebc311caae5657
SHA256

a5f341173a288b07f6f6725bf77255c9ed011606856e31cd4385f753023fe6d3
SHA512

0e723476acc8e4e05bd331185404cda17f3e30a4c564781b3931342ac278df78a2322a86f4c02a7c004eb6e4df8d51297f97d031f07c460137fefcfe85cbad03
SSDEEP

3072:sr0L65FLqJ/eqMLa82nM5EQFuPUnIJRIPb+FSJFaNb6:40LwFeJLMLn2RBPRJ8Ha

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1708	2072	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 1708	2072	a5f341173a288b07f6f6725bf77255c9ed011606856e31cd4385f753023fe6d3.exe	28
PID 2072 wrote to memory of 1708	2072	a5f341173a288b07f6f6725bf77255c9ed011606856e31cd4385f753023fe6d3.exe	28
PID 2072 wrote to memory of 1708	2072	a5f341173a288b07f6f6725bf77255c9ed011606856e31cd4385f753023fe6d3.exe	28
PID 2072 wrote to memory of 1708	2072	a5f341173a288b07f6f6725bf77255c9ed011606856e31cd4385f753023fe6d3.exe	28

C:\Users\Admin\AppData\Local\Temp\a5f341173a288b07f6f6725bf77255c9ed011606856e31cd4385f753023fe6d3.exe
"C:\Users\Admin\AppData\Local\Temp\a5f341173a288b07f6f6725bf77255c9ed011606856e31cd4385f753023fe6d3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 396
  2⤵
  - Program crash
  PID:1708

memory/2072-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2072-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download