8ea7dc650d0f2566eedd5a71fae9e3751e745223a48b9e05c12906e95e996c03

Analysis

max time kernel
35s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 00:29

Target

8ea7dc650d0f2566eedd5a71fae9e3751e745223a48b9e05c12906e95e996c03.exe
Size

49KB
MD5

a2e7a8d733c0226accdff2e460bd5b24
SHA1

11f6d7d5051cd75df5c2eab0bab784717ce44409
SHA256

8ea7dc650d0f2566eedd5a71fae9e3751e745223a48b9e05c12906e95e996c03
SHA512

cedeadebb31e0235436fc87497c44cf58685b9ac6c2c5a23670dcdd4c466260dac305cab865c4e463d62689d3a4f4684da3b2fa46f392e6de526aece5ccfa83f
SSDEEP

768:1AAVJKDRmHdYSkNV3wv8DXZwtexZ7K3j3oIIcAW3yHBJ0MGUlTwxYyRd1nCG:1AAfKD01k/gEKtex24LWwkixwxzX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1064	1032	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 1064	1032	8ea7dc650d0f2566eedd5a71fae9e3751e745223a48b9e05c12906e95e996c03.exe	28
PID 1032 wrote to memory of 1064	1032	8ea7dc650d0f2566eedd5a71fae9e3751e745223a48b9e05c12906e95e996c03.exe	28
PID 1032 wrote to memory of 1064	1032	8ea7dc650d0f2566eedd5a71fae9e3751e745223a48b9e05c12906e95e996c03.exe	28
PID 1032 wrote to memory of 1064	1032	8ea7dc650d0f2566eedd5a71fae9e3751e745223a48b9e05c12906e95e996c03.exe	28

C:\Users\Admin\AppData\Local\Temp\8ea7dc650d0f2566eedd5a71fae9e3751e745223a48b9e05c12906e95e996c03.exe
"C:\Users\Admin\AppData\Local\Temp\8ea7dc650d0f2566eedd5a71fae9e3751e745223a48b9e05c12906e95e996c03.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 36
  2⤵
  - Program crash
  PID:1064

memory/1032-55-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download