8f75dd4556153a48e5c5f0bc50fa0cdffcf4b4ae3aca944c753e84eef1e31024

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 05:33

Target

8f75dd4556153a48e5c5f0bc50fa0cdffcf4b4ae3aca944c753e84eef1e31024.exe
Size

128KB
MD5

2cdc760b4a6da207b35d8b73618dd8e0
SHA1

37d7910b4ae01cf3798b1ea0541df9b09ceac4aa
SHA256

8f75dd4556153a48e5c5f0bc50fa0cdffcf4b4ae3aca944c753e84eef1e31024
SHA512

44db30cf1aadb29035529d6093cd0e9338fe593641820c541adf813053de504735790c06848fbc853ef3ca9ebe189cb9e9a6c0024006edab6c7369649827c063
SSDEEP

24:yW3MtVCvZnNu0yW3MtVCvZnNAu/W3MtVCvZnNAu:t3Mfs/3Mfsc3Mfs

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2040	1152	WerFault.exe	8

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 2040	1152	8f75dd4556153a48e5c5f0bc50fa0cdffcf4b4ae3aca944c753e84eef1e31024.exe	27
PID 1152 wrote to memory of 2040	1152	8f75dd4556153a48e5c5f0bc50fa0cdffcf4b4ae3aca944c753e84eef1e31024.exe	27
PID 1152 wrote to memory of 2040	1152	8f75dd4556153a48e5c5f0bc50fa0cdffcf4b4ae3aca944c753e84eef1e31024.exe	27
PID 1152 wrote to memory of 2040	1152	8f75dd4556153a48e5c5f0bc50fa0cdffcf4b4ae3aca944c753e84eef1e31024.exe	27

C:\Users\Admin\AppData\Local\Temp\8f75dd4556153a48e5c5f0bc50fa0cdffcf4b4ae3aca944c753e84eef1e31024.exe
"C:\Users\Admin\AppData\Local\Temp\8f75dd4556153a48e5c5f0bc50fa0cdffcf4b4ae3aca944c753e84eef1e31024.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 36
  2⤵
  - Program crash
  PID:2040