5dbd5aa87712e888588dac993922b807318c25e817d6579134e66b7443e73d20

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:01

Target

5dbd5aa87712e888588dac993922b807318c25e817d6579134e66b7443e73d20.exe
Size

199KB
MD5

035fbcfe95170d1dcc487bcebbb28220
SHA1

3fdd5dc03bf338a9c4708a56abc0b89db937a646
SHA256

5dbd5aa87712e888588dac993922b807318c25e817d6579134e66b7443e73d20
SHA512

bc5f7a27e98f6381da74f43bd0e952b95b87b136c898a3d4b57bd80815b3115dfe3e61cd4a49a27a3b5015ad59380f2dfacfd6ea3b9b4645bfe966ac2095b5d5
SSDEEP

3072:UhwqY5wzuIL36w41r7WnBdN4tj0vjl8r+t50h69mpSSnMBJrECYV0vpx:SYVWKX57qvCGZ8rI869mXMBJrwVgp

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2316 2892 WerFault.exe 5dbd5aa87712e888588dac993922b807318c25e817d6579134e66b7443e73d20.exe

pid	pid_target	process	target process
2316	2892	WerFault.exe	5dbd5aa87712e888588dac993922b807318c25e817d6579134e66b7443e73d20.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5dbd5aa87712e888588dac993922b807318c25e817d6579134e66b7443e73d20.exe

description	pid	process	target process
PID 2892 wrote to memory of 2316	2892	5dbd5aa87712e888588dac993922b807318c25e817d6579134e66b7443e73d20.exe	WerFault.exe
PID 2892 wrote to memory of 2316	2892	5dbd5aa87712e888588dac993922b807318c25e817d6579134e66b7443e73d20.exe	WerFault.exe
PID 2892 wrote to memory of 2316	2892	5dbd5aa87712e888588dac993922b807318c25e817d6579134e66b7443e73d20.exe	WerFault.exe
PID 2892 wrote to memory of 2316	2892	5dbd5aa87712e888588dac993922b807318c25e817d6579134e66b7443e73d20.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\5dbd5aa87712e888588dac993922b807318c25e817d6579134e66b7443e73d20.exe
"C:\Users\Admin\AppData\Local\Temp\5dbd5aa87712e888588dac993922b807318c25e817d6579134e66b7443e73d20.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 36
2⤵
- Program crash
PID:2316

memory/2892-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download