b8d85317422e59230f0b05e364d490858086f6785b160a0d35ec4eb66dcec2fe

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:14

Target

b8d85317422e59230f0b05e364d490858086f6785b160a0d35ec4eb66dcec2fe.exe
Size

253KB
MD5

35f8be9be10b8a77f71a8d0682d90eb0
SHA1

5f8abffbb5fc7c05bc3b784f399c5b171d7e2000
SHA256

b8d85317422e59230f0b05e364d490858086f6785b160a0d35ec4eb66dcec2fe
SHA512

f2ccba082e79428745a0cf48b9affb68e744e454054d83c1e6db721317e4f5e51b3aaf2a69f34c7654883fe9cb8072ca272eeb8c03677d821df3335bb2aecb72
SSDEEP

6144:PeAG4sbUctzbfBYkopFoZR0y8ftCF5HrjrICF4D:23JfBZEwChtCDUsI

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

860 1668 WerFault.exe b8d85317422e59230f0b05e364d490858086f6785b160a0d35ec4eb66dcec2fe.exe

pid	pid_target	process	target process
860	1668	WerFault.exe	b8d85317422e59230f0b05e364d490858086f6785b160a0d35ec4eb66dcec2fe.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

b8d85317422e59230f0b05e364d490858086f6785b160a0d35ec4eb66dcec2fe.exe

description	pid	process	target process
PID 1668 wrote to memory of 860	1668	b8d85317422e59230f0b05e364d490858086f6785b160a0d35ec4eb66dcec2fe.exe	WerFault.exe
PID 1668 wrote to memory of 860	1668	b8d85317422e59230f0b05e364d490858086f6785b160a0d35ec4eb66dcec2fe.exe	WerFault.exe
PID 1668 wrote to memory of 860	1668	b8d85317422e59230f0b05e364d490858086f6785b160a0d35ec4eb66dcec2fe.exe	WerFault.exe
PID 1668 wrote to memory of 860	1668	b8d85317422e59230f0b05e364d490858086f6785b160a0d35ec4eb66dcec2fe.exe	WerFault.exe
PID 1668 wrote to memory of 860	1668	b8d85317422e59230f0b05e364d490858086f6785b160a0d35ec4eb66dcec2fe.exe	WerFault.exe
PID 1668 wrote to memory of 860	1668	b8d85317422e59230f0b05e364d490858086f6785b160a0d35ec4eb66dcec2fe.exe	WerFault.exe
PID 1668 wrote to memory of 860	1668	b8d85317422e59230f0b05e364d490858086f6785b160a0d35ec4eb66dcec2fe.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\b8d85317422e59230f0b05e364d490858086f6785b160a0d35ec4eb66dcec2fe.exe
"C:\Users\Admin\AppData\Local\Temp\b8d85317422e59230f0b05e364d490858086f6785b160a0d35ec4eb66dcec2fe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 276
2⤵
- Program crash
PID:860

memory/860-57-0x0000000000000000-mapping.dmp

Download
memory/1668-54-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/1668-55-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1668-56-0x0000000000240000-0x0000000000282000-memory.dmp

Filesize
264KB

Download