5c890ad2d645cd441de25f5b9de465b307ef4321ab81420342f4493e799deaf3

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 05:35

Target

5c890ad2d645cd441de25f5b9de465b307ef4321ab81420342f4493e799deaf3.exe
Size

674KB
MD5

11ec1f84af4dedb67694163e4b03464e
SHA1

bd4b6eca3f00eaf3df155838a1af1aa622af9a44
SHA256

5c890ad2d645cd441de25f5b9de465b307ef4321ab81420342f4493e799deaf3
SHA512

1106afdac10ea03efac5db8576b35fe2d2594664584e276a383202615902000c6850bb3384398a5fd4cb52a2dd4ae24d69158b00fb03e539b6245af0c7b1ffbe
SSDEEP

12288:O43R+xfofR3PBrhGLxe0DJC2z97xNKF+ygpa0L708uae7D3cdW:O2R+xfofR3PBrux7DJCit/KgFpXY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1992	1372	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 1992	1372	5c890ad2d645cd441de25f5b9de465b307ef4321ab81420342f4493e799deaf3.exe	28
PID 1372 wrote to memory of 1992	1372	5c890ad2d645cd441de25f5b9de465b307ef4321ab81420342f4493e799deaf3.exe	28
PID 1372 wrote to memory of 1992	1372	5c890ad2d645cd441de25f5b9de465b307ef4321ab81420342f4493e799deaf3.exe	28
PID 1372 wrote to memory of 1992	1372	5c890ad2d645cd441de25f5b9de465b307ef4321ab81420342f4493e799deaf3.exe	28

C:\Users\Admin\AppData\Local\Temp\5c890ad2d645cd441de25f5b9de465b307ef4321ab81420342f4493e799deaf3.exe
"C:\Users\Admin\AppData\Local\Temp\5c890ad2d645cd441de25f5b9de465b307ef4321ab81420342f4493e799deaf3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 36
  2⤵
  - Program crash
  PID:1992