ed8579cc8fbc7d4f487d662539b1509b228c8320cd5d01847f30580a806f75b3

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 16:54

Target

ed8579cc8fbc7d4f487d662539b1509b228c8320cd5d01847f30580a806f75b3.exe
Size

366KB
MD5

813dcaf28cee6ea257882f46007190da
SHA1

829406ae21a8b23b58121dcfeb5a1c134100ebed
SHA256

ed8579cc8fbc7d4f487d662539b1509b228c8320cd5d01847f30580a806f75b3
SHA512

0c381ec3d674a2f4c0b9611bdca3e1a2227cc5dc1a9166e040cc0ba664b7a547d66949804fabb98f8060ccdc944f38e7316f59f2555d8d74a245da02dc875c54
SSDEEP

3072:fQL/bCrwIPe5ML7nwkg7jqeQYu4Xap39Vp0zrY2cNtRf4WTHzSSfNlF4HteAlMvK:fQL/bCr5KnQYdapXpMcyWTHxl28AlM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1156	1600	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1156	1600	ed8579cc8fbc7d4f487d662539b1509b228c8320cd5d01847f30580a806f75b3.exe	27
PID 1600 wrote to memory of 1156	1600	ed8579cc8fbc7d4f487d662539b1509b228c8320cd5d01847f30580a806f75b3.exe	27
PID 1600 wrote to memory of 1156	1600	ed8579cc8fbc7d4f487d662539b1509b228c8320cd5d01847f30580a806f75b3.exe	27
PID 1600 wrote to memory of 1156	1600	ed8579cc8fbc7d4f487d662539b1509b228c8320cd5d01847f30580a806f75b3.exe	27

C:\Users\Admin\AppData\Local\Temp\ed8579cc8fbc7d4f487d662539b1509b228c8320cd5d01847f30580a806f75b3.exe
"C:\Users\Admin\AppData\Local\Temp\ed8579cc8fbc7d4f487d662539b1509b228c8320cd5d01847f30580a806f75b3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 116
  2⤵
  - Program crash
  PID:1156

memory/1600-54-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download
memory/1600-56-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download