87f819a4124601b058a184c8d55db89c7931d09a9380a23cb8c3aa3a376e933c

Analysis

max time kernel
22s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 17:54

Target

87f819a4124601b058a184c8d55db89c7931d09a9380a23cb8c3aa3a376e933c.exe
Size

167KB
MD5

81ed411c9e96a2b50eebc48f23ed5280
SHA1

33f8faedd12791ee27d4653434b1a719fc855d06
SHA256

87f819a4124601b058a184c8d55db89c7931d09a9380a23cb8c3aa3a376e933c
SHA512

8fb0d1a672a6cbf108528940bcac04bd33027a08d7cda23ce2b4b453f2a40ce72a29c23d190c222c3834ae619b59b16f405550ca3b159ff3e2a8c70031429da0
SSDEEP

3072:7NQKPWDybI0fFJltZrpReFX3QBO2wE9f8ws9F2g9BbavY0Fuw/Z8f:7NSDybIkFthpzO2wyEUDum

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1672	1008	WerFault.exe	12

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 1672	1008	87f819a4124601b058a184c8d55db89c7931d09a9380a23cb8c3aa3a376e933c.exe	28
PID 1008 wrote to memory of 1672	1008	87f819a4124601b058a184c8d55db89c7931d09a9380a23cb8c3aa3a376e933c.exe	28
PID 1008 wrote to memory of 1672	1008	87f819a4124601b058a184c8d55db89c7931d09a9380a23cb8c3aa3a376e933c.exe	28
PID 1008 wrote to memory of 1672	1008	87f819a4124601b058a184c8d55db89c7931d09a9380a23cb8c3aa3a376e933c.exe	28

C:\Users\Admin\AppData\Local\Temp\87f819a4124601b058a184c8d55db89c7931d09a9380a23cb8c3aa3a376e933c.exe
"C:\Users\Admin\AppData\Local\Temp\87f819a4124601b058a184c8d55db89c7931d09a9380a23cb8c3aa3a376e933c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 160
  2⤵
  - Program crash
  PID:1672

memory/1008-54-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download
memory/1008-56-0x0000000001000000-0x0000000001025000-memory.dmp

Filesize
148KB

Download