8f85bd607da7ccb3206b09b12fafdb57fccab8e30ec811e8a1ce7e4ae793bc67

Analysis

max time kernel
32s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 03:00

Target

8f85bd607da7ccb3206b09b12fafdb57fccab8e30ec811e8a1ce7e4ae793bc67.exe
Size

15KB
MD5

cd7ed294d498080a3f03f0d9ec8f5ef9
SHA1

ba51dfd52d0df40f5af107e27f3a714e620c4178
SHA256

8f85bd607da7ccb3206b09b12fafdb57fccab8e30ec811e8a1ce7e4ae793bc67
SHA512

474e28aa9b3de1d9c3b26e76ee999589a44aaf2831b57e97ea10624e3230ae7cef55fd63e45c231e3b8fa4278b5c0e306a9e53f008cac6fa222c4275446e1e2b
SSDEEP

384:LFftjfDF0uhBT6RyRSkrJ4/gW7yGmUjwnBC/USoQWUOZ:Lnzp0cTRRZYTmUaBgUSoKy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
912	1632	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 912	1632	8f85bd607da7ccb3206b09b12fafdb57fccab8e30ec811e8a1ce7e4ae793bc67.exe	28
PID 1632 wrote to memory of 912	1632	8f85bd607da7ccb3206b09b12fafdb57fccab8e30ec811e8a1ce7e4ae793bc67.exe	28
PID 1632 wrote to memory of 912	1632	8f85bd607da7ccb3206b09b12fafdb57fccab8e30ec811e8a1ce7e4ae793bc67.exe	28
PID 1632 wrote to memory of 912	1632	8f85bd607da7ccb3206b09b12fafdb57fccab8e30ec811e8a1ce7e4ae793bc67.exe	28

C:\Users\Admin\AppData\Local\Temp\8f85bd607da7ccb3206b09b12fafdb57fccab8e30ec811e8a1ce7e4ae793bc67.exe
"C:\Users\Admin\AppData\Local\Temp\8f85bd607da7ccb3206b09b12fafdb57fccab8e30ec811e8a1ce7e4ae793bc67.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 36
  2⤵
  - Program crash
  PID:912