8238054884b08eb0dc4df57a0a7dd181d72d3996b2ecbd958065c3bb7204844e

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 14:51

Target

8238054884b08eb0dc4df57a0a7dd181d72d3996b2ecbd958065c3bb7204844e.exe
Size

50KB
MD5

93f34ddc88cc75a40d825f84377481f0
SHA1

b67e2228837773501755cc5b1c4c091231fe4b2b
SHA256

8238054884b08eb0dc4df57a0a7dd181d72d3996b2ecbd958065c3bb7204844e
SHA512

d2be04f792772f3af444389511125d22fbca30b234012060192b3ba155eef2ef6d9c8c839c04f6af49468f43dae5da8e5a36cc153b7ec3c5e1add9feb4921b5c
SSDEEP

768:hUjKVjl9xw3x6nzDvj1wrxP83CRRu3G3WJG2DgEkcEOsLKIi9fQEw2ZO:hUKJ3z7j1w1/RYrpsAKKZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1852	800	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 1852	800	8238054884b08eb0dc4df57a0a7dd181d72d3996b2ecbd958065c3bb7204844e.exe	28
PID 800 wrote to memory of 1852	800	8238054884b08eb0dc4df57a0a7dd181d72d3996b2ecbd958065c3bb7204844e.exe	28
PID 800 wrote to memory of 1852	800	8238054884b08eb0dc4df57a0a7dd181d72d3996b2ecbd958065c3bb7204844e.exe	28
PID 800 wrote to memory of 1852	800	8238054884b08eb0dc4df57a0a7dd181d72d3996b2ecbd958065c3bb7204844e.exe	28

C:\Users\Admin\AppData\Local\Temp\8238054884b08eb0dc4df57a0a7dd181d72d3996b2ecbd958065c3bb7204844e.exe
"C:\Users\Admin\AppData\Local\Temp\8238054884b08eb0dc4df57a0a7dd181d72d3996b2ecbd958065c3bb7204844e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 120
  2⤵
  - Program crash
  PID:1852

memory/800-54-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download
memory/800-55-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/800-56-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download