8c086aa247614e3676680fe7b264d6f9b04de324dd5c71b2989091a48dcc8e89

Analysis

max time kernel
39s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:18

Target

8c086aa247614e3676680fe7b264d6f9b04de324dd5c71b2989091a48dcc8e89.exe
Size

80KB
MD5

ee1ab4f0a0090454a51b3121074dcf1b
SHA1

bc1c7804459cb47289fc7eaafe4f93ffe060d421
SHA256

8c086aa247614e3676680fe7b264d6f9b04de324dd5c71b2989091a48dcc8e89
SHA512

22043cdd323abbf5576061ca5ccbcdb28132f96957e6c025c1f3dbee59ffecd02166bf5f7ad950f87a53827f8eeb33e23bf9292e145df32c3c41df0529d3207a
SSDEEP

1536:i7Rtcv05MhkU+TjUqNlIoz1IDBYut0cqNtXnQD82hW8fPL:iFO85MhEYZi8YO2tAD8vYL

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

364 1468 WerFault.exe 8c086aa247614e3676680fe7b264d6f9b04de324dd5c71b2989091a48dcc8e89.exe

pid	pid_target	process	target process
364	1468	WerFault.exe	8c086aa247614e3676680fe7b264d6f9b04de324dd5c71b2989091a48dcc8e89.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8c086aa247614e3676680fe7b264d6f9b04de324dd5c71b2989091a48dcc8e89.exe

description	pid	process	target process
PID 1468 wrote to memory of 364	1468	8c086aa247614e3676680fe7b264d6f9b04de324dd5c71b2989091a48dcc8e89.exe	WerFault.exe
PID 1468 wrote to memory of 364	1468	8c086aa247614e3676680fe7b264d6f9b04de324dd5c71b2989091a48dcc8e89.exe	WerFault.exe
PID 1468 wrote to memory of 364	1468	8c086aa247614e3676680fe7b264d6f9b04de324dd5c71b2989091a48dcc8e89.exe	WerFault.exe
PID 1468 wrote to memory of 364	1468	8c086aa247614e3676680fe7b264d6f9b04de324dd5c71b2989091a48dcc8e89.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\8c086aa247614e3676680fe7b264d6f9b04de324dd5c71b2989091a48dcc8e89.exe
"C:\Users\Admin\AppData\Local\Temp\8c086aa247614e3676680fe7b264d6f9b04de324dd5c71b2989091a48dcc8e89.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 36
2⤵
- Program crash
PID:364

memory/364-55-0x0000000000000000-mapping.dmp

Download
memory/1468-54-0x0000000000400000-0x0000000000425E52-memory.dmp

Filesize
151KB

Download