8c696cbea918aea409b6a792bdb5fdf7779c08577176289d808c367f61d53852

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
14-10-2022 11:14

Target

8c696cbea918aea409b6a792bdb5fdf7779c08577176289d808c367f61d53852.exe
Size

80KB
MD5

4381c7df78aee37a960552b1be0141d1
SHA1

fedd954251445286b53383937f2e1160c43b3dcb
SHA256

8c696cbea918aea409b6a792bdb5fdf7779c08577176289d808c367f61d53852
SHA512

d4d116cf75683f2e4ff36a179798b96e1fdfad45ca198321baf314ac6480398a1360aec66de91b5648a55912741b5db858888c3ce254ed2e028689b1cce31d0b
SSDEEP

1536:Qfx7fXe5h42XqnKybMZLRAQ7EasdkqV7ERS8T4lKfN7y1G:CexanoBRAQ7WeqRExuKfE1G

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1160	1720	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1160	1720	8c696cbea918aea409b6a792bdb5fdf7779c08577176289d808c367f61d53852.exe	27
PID 1720 wrote to memory of 1160	1720	8c696cbea918aea409b6a792bdb5fdf7779c08577176289d808c367f61d53852.exe	27
PID 1720 wrote to memory of 1160	1720	8c696cbea918aea409b6a792bdb5fdf7779c08577176289d808c367f61d53852.exe	27
PID 1720 wrote to memory of 1160	1720	8c696cbea918aea409b6a792bdb5fdf7779c08577176289d808c367f61d53852.exe	27

C:\Users\Admin\AppData\Local\Temp\8c696cbea918aea409b6a792bdb5fdf7779c08577176289d808c367f61d53852.exe
"C:\Users\Admin\AppData\Local\Temp\8c696cbea918aea409b6a792bdb5fdf7779c08577176289d808c367f61d53852.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 164
  2⤵
  - Program crash
  PID:1160

memory/1160-55-0x0000000000000000-mapping.dmp

Download
memory/1720-54-0x00000000765B1000-0x00000000765B3000-memory.dmp

Filesize
8KB

Download
memory/1720-56-0x0000000001000000-0x000000000101B000-memory.dmp

Filesize
108KB

Download