8b2c2ed2caadf6dc589204661f74e67956d755ef8ac932008c8efa92db858cfa

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:22

Target

8b2c2ed2caadf6dc589204661f74e67956d755ef8ac932008c8efa92db858cfa.exe
Size

66KB
MD5

a20e4ebafe8f48723b9750ad1101cd41
SHA1

6c1272e289ba0ad42c7cb9e0cead286c9749f41c
SHA256

8b2c2ed2caadf6dc589204661f74e67956d755ef8ac932008c8efa92db858cfa
SHA512

f71e6a6ffc7920b289e3241f4deed50bf0071f653339f5d8e6479049d922141c432df192acbc856bd40546c386caa2980284a68c5bb2f216975a2598d9aa9512
SSDEEP

1536:VxcbSkqQHGO5WOiVKggBXdyZuPpIeZqJxxVfBd:kbS0p5WOiVUBXSuPlG1fL

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1252 1760 WerFault.exe 8b2c2ed2caadf6dc589204661f74e67956d755ef8ac932008c8efa92db858cfa.exe

pid	pid_target	process	target process
1252	1760	WerFault.exe	8b2c2ed2caadf6dc589204661f74e67956d755ef8ac932008c8efa92db858cfa.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8b2c2ed2caadf6dc589204661f74e67956d755ef8ac932008c8efa92db858cfa.exe

description	pid	process	target process
PID 1760 wrote to memory of 1252	1760	8b2c2ed2caadf6dc589204661f74e67956d755ef8ac932008c8efa92db858cfa.exe	WerFault.exe
PID 1760 wrote to memory of 1252	1760	8b2c2ed2caadf6dc589204661f74e67956d755ef8ac932008c8efa92db858cfa.exe	WerFault.exe
PID 1760 wrote to memory of 1252	1760	8b2c2ed2caadf6dc589204661f74e67956d755ef8ac932008c8efa92db858cfa.exe	WerFault.exe
PID 1760 wrote to memory of 1252	1760	8b2c2ed2caadf6dc589204661f74e67956d755ef8ac932008c8efa92db858cfa.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\8b2c2ed2caadf6dc589204661f74e67956d755ef8ac932008c8efa92db858cfa.exe
"C:\Users\Admin\AppData\Local\Temp\8b2c2ed2caadf6dc589204661f74e67956d755ef8ac932008c8efa92db858cfa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 36
  2⤵
  - Program crash
  PID:1252

memory/1252-54-0x0000000000000000-mapping.dmp

Download
memory/1760-55-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download