8a410cba401469ee399a67845376fbcd1e8a9af0e73fd6b623fe1e1c068d1e2b

Analysis

max time kernel
26s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:44

Target

8a410cba401469ee399a67845376fbcd1e8a9af0e73fd6b623fe1e1c068d1e2b.exe
Size

197KB
MD5

bfae80710b1385b35931e252e32d27bb
SHA1

648daacd2452e2f0bcee111fe286ec94acdd6898
SHA256

8a410cba401469ee399a67845376fbcd1e8a9af0e73fd6b623fe1e1c068d1e2b
SHA512

e37ccbf1ab99377ff3a103b0195b2d36245e90971303bef46d4705500987c43c0b8420ca6c94f0c4d394ed8164a552e5732c0e609d9bf3dfab3cfcd640f6648e
SSDEEP

6144:qpe8IA7yIrnmkrpRsF1a42cm7muWdgPu8:q3ItqX42cmadgW8

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2028 1736 WerFault.exe 8a410cba401469ee399a67845376fbcd1e8a9af0e73fd6b623fe1e1c068d1e2b.exe

pid	pid_target	process	target process
2028	1736	WerFault.exe	8a410cba401469ee399a67845376fbcd1e8a9af0e73fd6b623fe1e1c068d1e2b.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8a410cba401469ee399a67845376fbcd1e8a9af0e73fd6b623fe1e1c068d1e2b.exe

description	pid	process	target process
PID 1736 wrote to memory of 2028	1736	8a410cba401469ee399a67845376fbcd1e8a9af0e73fd6b623fe1e1c068d1e2b.exe	WerFault.exe
PID 1736 wrote to memory of 2028	1736	8a410cba401469ee399a67845376fbcd1e8a9af0e73fd6b623fe1e1c068d1e2b.exe	WerFault.exe
PID 1736 wrote to memory of 2028	1736	8a410cba401469ee399a67845376fbcd1e8a9af0e73fd6b623fe1e1c068d1e2b.exe	WerFault.exe
PID 1736 wrote to memory of 2028	1736	8a410cba401469ee399a67845376fbcd1e8a9af0e73fd6b623fe1e1c068d1e2b.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\8a410cba401469ee399a67845376fbcd1e8a9af0e73fd6b623fe1e1c068d1e2b.exe
"C:\Users\Admin\AppData\Local\Temp\8a410cba401469ee399a67845376fbcd1e8a9af0e73fd6b623fe1e1c068d1e2b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 36
2⤵
- Program crash
PID:2028

memory/1736-55-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2028-54-0x0000000000000000-mapping.dmp

Download