8ea2fc86d624d96abd7c1fb8c3242958cc00a3cc0bc50cda2c7efed90796beb0

Analysis

max time kernel
33s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 10:59

Target

8ea2fc86d624d96abd7c1fb8c3242958cc00a3cc0bc50cda2c7efed90796beb0.exe
Size

233KB
MD5

712ebcf732de648db02428b7743ada30
SHA1

29afa4b34dbcd1350d885d9dc9afdd93091411b3
SHA256

8ea2fc86d624d96abd7c1fb8c3242958cc00a3cc0bc50cda2c7efed90796beb0
SHA512

69e7ea53eb6d2104ea0eeb66749b24894ab7f534e7928b68cf7c1975eba5f40c008a1e3d0af9fd6b498e7d81579b4b224c24bfdbaac014d1420391aa2d5d40e3
SSDEEP

3072:70H6O/n4UGBfEQjIul2C+2IMVtYb0U1uj1Dg4IA:70aO/4UGBLIpWtYb0UUjg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1476	1388	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1476	1388	8ea2fc86d624d96abd7c1fb8c3242958cc00a3cc0bc50cda2c7efed90796beb0.exe	26
PID 1388 wrote to memory of 1476	1388	8ea2fc86d624d96abd7c1fb8c3242958cc00a3cc0bc50cda2c7efed90796beb0.exe	26
PID 1388 wrote to memory of 1476	1388	8ea2fc86d624d96abd7c1fb8c3242958cc00a3cc0bc50cda2c7efed90796beb0.exe	26
PID 1388 wrote to memory of 1476	1388	8ea2fc86d624d96abd7c1fb8c3242958cc00a3cc0bc50cda2c7efed90796beb0.exe	26

C:\Users\Admin\AppData\Local\Temp\8ea2fc86d624d96abd7c1fb8c3242958cc00a3cc0bc50cda2c7efed90796beb0.exe
"C:\Users\Admin\AppData\Local\Temp\8ea2fc86d624d96abd7c1fb8c3242958cc00a3cc0bc50cda2c7efed90796beb0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 88
  2⤵
  - Program crash
  PID:1476

memory/1388-54-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download