8f8bdaa6b45f58c48691f15df90a23c9f31a1ff9a1ce32c97a20176ead77eda8

Analysis

max time kernel
90s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 05:16

Target

8f8bdaa6b45f58c48691f15df90a23c9f31a1ff9a1ce32c97a20176ead77eda8.exe
Size

291KB
MD5

0de8b8a11a85ae675374febfafbc6ec5
SHA1

eb5858930eedbc730de55430f050157bdfcba380
SHA256

8f8bdaa6b45f58c48691f15df90a23c9f31a1ff9a1ce32c97a20176ead77eda8
SHA512

9420014985c89cf92209254a710fa242af741832f88989f1403395e85883500d04ede91ad049db29a64fa9ab7e0db9154a46582a1b95d540b88ee6ce6dbcbb52
SSDEEP

6144:MTX+O75HRtCaujfVzYb/soRUwNRmX0fw2NLUgYUvNcfDFbBCJ:MTXD/CB0owNUGw2l5yrFbBCJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1344	1868	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 1344	1868	8f8bdaa6b45f58c48691f15df90a23c9f31a1ff9a1ce32c97a20176ead77eda8.exe	28
PID 1868 wrote to memory of 1344	1868	8f8bdaa6b45f58c48691f15df90a23c9f31a1ff9a1ce32c97a20176ead77eda8.exe	28
PID 1868 wrote to memory of 1344	1868	8f8bdaa6b45f58c48691f15df90a23c9f31a1ff9a1ce32c97a20176ead77eda8.exe	28
PID 1868 wrote to memory of 1344	1868	8f8bdaa6b45f58c48691f15df90a23c9f31a1ff9a1ce32c97a20176ead77eda8.exe	28

C:\Users\Admin\AppData\Local\Temp\8f8bdaa6b45f58c48691f15df90a23c9f31a1ff9a1ce32c97a20176ead77eda8.exe
"C:\Users\Admin\AppData\Local\Temp\8f8bdaa6b45f58c48691f15df90a23c9f31a1ff9a1ce32c97a20176ead77eda8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 96
  2⤵
  - Program crash
  PID:1344

memory/1868-54-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1868-57-0x00000000001D0000-0x00000000001DD000-memory.dmp

Filesize
52KB

Download
memory/1868-56-0x00000000001B0000-0x00000000001C0000-memory.dmp

Filesize
64KB

Download
memory/1868-55-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download