58e8a9770a7c4933522eb13d3194d8551bc8cc6fe4736a1316fceb1f6111d4f3

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 23:37

Target

58e8a9770a7c4933522eb13d3194d8551bc8cc6fe4736a1316fceb1f6111d4f3.exe
Size

163KB
MD5

7b882f62b7524951123d164b5cd8f1d0
SHA1

754c69bc0d5c94a8983bec71486fb2f6a5e7a0a8
SHA256

58e8a9770a7c4933522eb13d3194d8551bc8cc6fe4736a1316fceb1f6111d4f3
SHA512

60517e60c52a4662929f835325979d8cf35720fba3561bc42494601e81545024badb9c7c199822594a9ad34544448f9e83883fe634f88be4e0122a06debc8062
SSDEEP

3072:Qa/F6aHv4BMAqI4XLYRXxTQT2qRLld3PJl4eabfa7m8JJ5:Qa/Fp4BF4XLihS2yDR4a7maJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
628	960	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 628	960	58e8a9770a7c4933522eb13d3194d8551bc8cc6fe4736a1316fceb1f6111d4f3.exe	27
PID 960 wrote to memory of 628	960	58e8a9770a7c4933522eb13d3194d8551bc8cc6fe4736a1316fceb1f6111d4f3.exe	27
PID 960 wrote to memory of 628	960	58e8a9770a7c4933522eb13d3194d8551bc8cc6fe4736a1316fceb1f6111d4f3.exe	27
PID 960 wrote to memory of 628	960	58e8a9770a7c4933522eb13d3194d8551bc8cc6fe4736a1316fceb1f6111d4f3.exe	27

C:\Users\Admin\AppData\Local\Temp\58e8a9770a7c4933522eb13d3194d8551bc8cc6fe4736a1316fceb1f6111d4f3.exe
"C:\Users\Admin\AppData\Local\Temp\58e8a9770a7c4933522eb13d3194d8551bc8cc6fe4736a1316fceb1f6111d4f3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 92
  2⤵
  - Program crash
  PID:628