8a7888e6a6426f00081cac008d6215f8f6935bdec50c90b296250ac47d9731d1

Analysis

max time kernel
38s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 12:46

Target

8a7888e6a6426f00081cac008d6215f8f6935bdec50c90b296250ac47d9731d1.exe
Size

63KB
MD5

4d1b3f397fac442bcd1f88c756354e10
SHA1

9a167e6cbb10c52edf6ae6e38a435daadf367593
SHA256

8a7888e6a6426f00081cac008d6215f8f6935bdec50c90b296250ac47d9731d1
SHA512

f03574484bd70d012b76d99a55a2ebf9bac673f5e085fbd465fabc12281220a2df476f071895865eb7f7fec002eb3c124f200b2376d58f78264a7d45e08aa0c7
SSDEEP

1536:YVWBLCZ+YJz3Cf3Isrofg9mhnZbq42WG/+htfJu5PhH/SzDdbHZ:YB+jAsrV9mjSShu5PF/SzDdbHZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1912	1340	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 1912	1340	8a7888e6a6426f00081cac008d6215f8f6935bdec50c90b296250ac47d9731d1.exe	28
PID 1340 wrote to memory of 1912	1340	8a7888e6a6426f00081cac008d6215f8f6935bdec50c90b296250ac47d9731d1.exe	28
PID 1340 wrote to memory of 1912	1340	8a7888e6a6426f00081cac008d6215f8f6935bdec50c90b296250ac47d9731d1.exe	28
PID 1340 wrote to memory of 1912	1340	8a7888e6a6426f00081cac008d6215f8f6935bdec50c90b296250ac47d9731d1.exe	28

C:\Users\Admin\AppData\Local\Temp\8a7888e6a6426f00081cac008d6215f8f6935bdec50c90b296250ac47d9731d1.exe
"C:\Users\Admin\AppData\Local\Temp\8a7888e6a6426f00081cac008d6215f8f6935bdec50c90b296250ac47d9731d1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 36
  2⤵
  - Program crash
  PID:1912

memory/1340-55-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download