8e48d359ad280dace399489c6eb5c9a934768228a0bfc3edb68e104dd41430ad

Analysis

max time kernel
45s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30-10-2022 00:36

Target

8e48d359ad280dace399489c6eb5c9a934768228a0bfc3edb68e104dd41430ad.exe
Size

310KB
MD5

541bebe3d11f6231ca810a6b909705f0
SHA1

04d97b9ef6ea2eba822305cb158551b6fc9911b0
SHA256

8e48d359ad280dace399489c6eb5c9a934768228a0bfc3edb68e104dd41430ad
SHA512

a3bafd60ec65ade9f12e25e2736e9df56dbe167ebd01cbb82ac9ed3b8ed236d5d383995f3efc7a196dbcce94043925f82ca1044e71fdf7661c9adb6be5815d1b
SSDEEP

768:oMGpZyablwQNxA5F1Hzel89f2h/foIIoF6K0SwU2e9Moz6:6saKQz+Ft0Of2iIqK0tde99

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1396	1600	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1396	1600	8e48d359ad280dace399489c6eb5c9a934768228a0bfc3edb68e104dd41430ad.exe	27
PID 1600 wrote to memory of 1396	1600	8e48d359ad280dace399489c6eb5c9a934768228a0bfc3edb68e104dd41430ad.exe	27
PID 1600 wrote to memory of 1396	1600	8e48d359ad280dace399489c6eb5c9a934768228a0bfc3edb68e104dd41430ad.exe	27
PID 1600 wrote to memory of 1396	1600	8e48d359ad280dace399489c6eb5c9a934768228a0bfc3edb68e104dd41430ad.exe	27

C:\Users\Admin\AppData\Local\Temp\8e48d359ad280dace399489c6eb5c9a934768228a0bfc3edb68e104dd41430ad.exe
"C:\Users\Admin\AppData\Local\Temp\8e48d359ad280dace399489c6eb5c9a934768228a0bfc3edb68e104dd41430ad.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 164
  2⤵
  - Program crash
  PID:1396