080da53a24f7b9181dac880eb8cdd58eb47ddb9f7deb133bfc82850a2e3fd232

Analysis

max time kernel
37s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 04:17

Target

080da53a24f7b9181dac880eb8cdd58eb47ddb9f7deb133bfc82850a2e3fd232.exe
Size

47KB
MD5

a2c569ec82e1c2d0988a83b9f9930b70
SHA1

5f276eae0697d735ac99faa1a167710f27ab299f
SHA256

080da53a24f7b9181dac880eb8cdd58eb47ddb9f7deb133bfc82850a2e3fd232
SHA512

b9496229c669f9356058a36c5a55c784d85673e148130dae8b2a6e35e9225f32c081c4b5ceb54c7521f80cd3ed62070f818cfda4ad5cff4fb4c5f7409cc47fe6
SSDEEP

768:0ORCDtO5r1OoZaYPFto36ib3hQ66WZn3sWX2qDBS2bQUKiq72feXNPSa4EBlnegq:TCO/LKbxQ6tnprlScpK12fENYETly+hZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1984	784	WerFault.exe	25

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
784	080da53a24f7b9181dac880eb8cdd58eb47ddb9f7deb133bfc82850a2e3fd232.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 1984	784	080da53a24f7b9181dac880eb8cdd58eb47ddb9f7deb133bfc82850a2e3fd232.exe	27
PID 784 wrote to memory of 1984	784	080da53a24f7b9181dac880eb8cdd58eb47ddb9f7deb133bfc82850a2e3fd232.exe	27
PID 784 wrote to memory of 1984	784	080da53a24f7b9181dac880eb8cdd58eb47ddb9f7deb133bfc82850a2e3fd232.exe	27
PID 784 wrote to memory of 1984	784	080da53a24f7b9181dac880eb8cdd58eb47ddb9f7deb133bfc82850a2e3fd232.exe	27

C:\Users\Admin\AppData\Local\Temp\080da53a24f7b9181dac880eb8cdd58eb47ddb9f7deb133bfc82850a2e3fd232.exe
"C:\Users\Admin\AppData\Local\Temp\080da53a24f7b9181dac880eb8cdd58eb47ddb9f7deb133bfc82850a2e3fd232.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 784 -s 124
  2⤵
  - Program crash
  PID:1984

memory/784-54-0x0000000000020000-0x0000000000026000-memory.dmp

Filesize
24KB

Download