b8bf1e48aa65c9b6f1412bff89db964476ae0b31485b35da4c2694380eb2e5de

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:21

Target

b8bf1e48aa65c9b6f1412bff89db964476ae0b31485b35da4c2694380eb2e5de.exe
Size

91KB
MD5

c2629669ad83c8b64bf1e7b522bdd95f
SHA1

0479eb3726a31bb6dcfd2808aef63f0a6919fb33
SHA256

b8bf1e48aa65c9b6f1412bff89db964476ae0b31485b35da4c2694380eb2e5de
SHA512

19a3363fc94c57bf8f22e5d9d7ac0c4a2ee61257bf04e262f709b07c815578174d587e5a12a42d14ccb4eb463df8fad8217ef92b49be8233e00757151db18614
SSDEEP

1536:1dCN67EYnmXycbXPU9REyEhPEgWydHaC/Fr3KKgwCJX3e9a48DzszMza86x/OSAN:aPYcTOEyEhPkydHaIFDKxwC13aTzFl

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1236 1348 WerFault.exe b8bf1e48aa65c9b6f1412bff89db964476ae0b31485b35da4c2694380eb2e5de.exe

pid	pid_target	process	target process
1236	1348	WerFault.exe	b8bf1e48aa65c9b6f1412bff89db964476ae0b31485b35da4c2694380eb2e5de.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b8bf1e48aa65c9b6f1412bff89db964476ae0b31485b35da4c2694380eb2e5de.exe

description	pid	process	target process
PID 1348 wrote to memory of 1236	1348	b8bf1e48aa65c9b6f1412bff89db964476ae0b31485b35da4c2694380eb2e5de.exe	WerFault.exe
PID 1348 wrote to memory of 1236	1348	b8bf1e48aa65c9b6f1412bff89db964476ae0b31485b35da4c2694380eb2e5de.exe	WerFault.exe
PID 1348 wrote to memory of 1236	1348	b8bf1e48aa65c9b6f1412bff89db964476ae0b31485b35da4c2694380eb2e5de.exe	WerFault.exe
PID 1348 wrote to memory of 1236	1348	b8bf1e48aa65c9b6f1412bff89db964476ae0b31485b35da4c2694380eb2e5de.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\b8bf1e48aa65c9b6f1412bff89db964476ae0b31485b35da4c2694380eb2e5de.exe
"C:\Users\Admin\AppData\Local\Temp\b8bf1e48aa65c9b6f1412bff89db964476ae0b31485b35da4c2694380eb2e5de.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 36
2⤵
- Program crash
PID:1236

memory/1236-54-0x0000000000000000-mapping.dmp

Download
memory/1348-55-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download