8ef75d8e2b532205a0bfb8584457927cd2aa58d4a699f8c1a813af039f4690e7

Analysis

max time kernel
78s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:40

Target

8ef75d8e2b532205a0bfb8584457927cd2aa58d4a699f8c1a813af039f4690e7.exe
Size

74KB
MD5

818ef89d1797abb8dba5ad2c3b97bf2b
SHA1

5935d89332f72a93cea0c4478c733b0d6053d1b3
SHA256

8ef75d8e2b532205a0bfb8584457927cd2aa58d4a699f8c1a813af039f4690e7
SHA512

646261beb78af3d0e6a7c64b71362c6af85c486e160b533cb77ee55ba665878ad71b47aea5d891dd4cafe3f2acc34e7dc6960e006cbc32ed75b55a0ab169bfec
SSDEEP

768:tMTDT/RmnxJiaBan+Oj0y1gAUbM7ZE/PfcnvOiX6CNS:6furs+iNJdP7NS

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

432 1168 WerFault.exe 8ef75d8e2b532205a0bfb8584457927cd2aa58d4a699f8c1a813af039f4690e7.exe

pid	pid_target	process	target process
432	1168	WerFault.exe	8ef75d8e2b532205a0bfb8584457927cd2aa58d4a699f8c1a813af039f4690e7.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8ef75d8e2b532205a0bfb8584457927cd2aa58d4a699f8c1a813af039f4690e7.exe

description	pid	process	target process
PID 1168 wrote to memory of 432	1168	8ef75d8e2b532205a0bfb8584457927cd2aa58d4a699f8c1a813af039f4690e7.exe	WerFault.exe
PID 1168 wrote to memory of 432	1168	8ef75d8e2b532205a0bfb8584457927cd2aa58d4a699f8c1a813af039f4690e7.exe	WerFault.exe
PID 1168 wrote to memory of 432	1168	8ef75d8e2b532205a0bfb8584457927cd2aa58d4a699f8c1a813af039f4690e7.exe	WerFault.exe
PID 1168 wrote to memory of 432	1168	8ef75d8e2b532205a0bfb8584457927cd2aa58d4a699f8c1a813af039f4690e7.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\8ef75d8e2b532205a0bfb8584457927cd2aa58d4a699f8c1a813af039f4690e7.exe
"C:\Users\Admin\AppData\Local\Temp\8ef75d8e2b532205a0bfb8584457927cd2aa58d4a699f8c1a813af039f4690e7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 36
  2⤵
  - Program crash
  PID:432

memory/432-56-0x0000000000000000-mapping.dmp

Download
memory/1168-54-0x0000000000402000-0x0000000000413000-memory.dmp

Filesize
68KB

Download
memory/1168-55-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download