a8668e79a49f3876c4ab827851b393222922aa43978c99aaaafdb20bdb4c6a4b

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
28/10/2022, 20:36

Target

a8668e79a49f3876c4ab827851b393222922aa43978c99aaaafdb20bdb4c6a4b.exe
Size

179KB
MD5

0007fa8e792d1e7a73620f7bbc40f9a0
SHA1

3f81d00bd18efe85b643a16652998ffa4ef27ef6
SHA256

a8668e79a49f3876c4ab827851b393222922aa43978c99aaaafdb20bdb4c6a4b
SHA512

272f2f41f205e9764ff0843324a26900daef4ceda95622d131e649009a2ab736266c391a781b27fa736d39f8ba2c3ec627e1cb95bf6d6051eb8e0c813111ac5b
SSDEEP

3072:1xyKT4pQBPlWjR3HNZFDxN5Eq4BSDADeak7dJHB/AdG6:zT6Qlo5tSqQSsQLH5AdT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1148	2012	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1148	2012	a8668e79a49f3876c4ab827851b393222922aa43978c99aaaafdb20bdb4c6a4b.exe	28
PID 2012 wrote to memory of 1148	2012	a8668e79a49f3876c4ab827851b393222922aa43978c99aaaafdb20bdb4c6a4b.exe	28
PID 2012 wrote to memory of 1148	2012	a8668e79a49f3876c4ab827851b393222922aa43978c99aaaafdb20bdb4c6a4b.exe	28
PID 2012 wrote to memory of 1148	2012	a8668e79a49f3876c4ab827851b393222922aa43978c99aaaafdb20bdb4c6a4b.exe	28

C:\Users\Admin\AppData\Local\Temp\a8668e79a49f3876c4ab827851b393222922aa43978c99aaaafdb20bdb4c6a4b.exe
"C:\Users\Admin\AppData\Local\Temp\a8668e79a49f3876c4ab827851b393222922aa43978c99aaaafdb20bdb4c6a4b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 96
  2⤵
  - Program crash
  PID:1148

memory/2012-55-0x00000000002F0000-0x0000000000322000-memory.dmp

Filesize
200KB

Download