8e3a9aae190e0e2d91bd89b996381bab8347f87e8023d674aee38628b4055b46

Analysis

max time kernel
89s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 05:36

Target

8e3a9aae190e0e2d91bd89b996381bab8347f87e8023d674aee38628b4055b46.exe
Size

131KB
MD5

5a4cd7bcfc3bd98ab4350413d4565660
SHA1

5e9426e2857260fa4eb938929d8b20d3ef32287d
SHA256

8e3a9aae190e0e2d91bd89b996381bab8347f87e8023d674aee38628b4055b46
SHA512

c634e42322cbd6a759470e31cc9d23a47883764ea4074b18f42d88ea8220e6e7ec0b666faf88a6d4791f66894169124a8d1b59cabb1056cddc6342bb94703e3a
SSDEEP

3072:SobHndIZAPX/meUhpg5WcH0jbP1gbUaKgQd4JXeoqqaaiyrUtytT:jbHnpPX/meUhS5WRfP1xfotaegY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1524	1164	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 1524	1164	8e3a9aae190e0e2d91bd89b996381bab8347f87e8023d674aee38628b4055b46.exe	28
PID 1164 wrote to memory of 1524	1164	8e3a9aae190e0e2d91bd89b996381bab8347f87e8023d674aee38628b4055b46.exe	28
PID 1164 wrote to memory of 1524	1164	8e3a9aae190e0e2d91bd89b996381bab8347f87e8023d674aee38628b4055b46.exe	28
PID 1164 wrote to memory of 1524	1164	8e3a9aae190e0e2d91bd89b996381bab8347f87e8023d674aee38628b4055b46.exe	28

C:\Users\Admin\AppData\Local\Temp\8e3a9aae190e0e2d91bd89b996381bab8347f87e8023d674aee38628b4055b46.exe
"C:\Users\Admin\AppData\Local\Temp\8e3a9aae190e0e2d91bd89b996381bab8347f87e8023d674aee38628b4055b46.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 96
  2⤵
  - Program crash
  PID:1524

memory/1164-55-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download