8de8cff82e0e362a1a19303e3455a4f89b012dd7bd00d3a3a57598c78a67d661

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 05:38

Target

8de8cff82e0e362a1a19303e3455a4f89b012dd7bd00d3a3a57598c78a67d661.exe
Size

47KB
MD5

325a095780367a219b76ff13645fa51d
SHA1

0984c27e16d08445d9a4c7085e886187dd007064
SHA256

8de8cff82e0e362a1a19303e3455a4f89b012dd7bd00d3a3a57598c78a67d661
SHA512

714b5fdc655020f57ca2148da930f5f7307ad8d2c0e5f5efbb44fbc18db77755cdfbda7de22d58dfa8ba7c64421c3e8927c506597b6ddff352d32537fe0fdf41
SSDEEP

768:i5jvEIg6v8nfIsnBOrD4k+kGKLYoW3f1ORWLcbb2sjiee1EfXyEy8M9L9T:i5jcIf7snBOr0lkGvo+gUgH2sgEfqB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2044	1896	WerFault.exe	12

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2044	1896	8de8cff82e0e362a1a19303e3455a4f89b012dd7bd00d3a3a57598c78a67d661.exe	27
PID 1896 wrote to memory of 2044	1896	8de8cff82e0e362a1a19303e3455a4f89b012dd7bd00d3a3a57598c78a67d661.exe	27
PID 1896 wrote to memory of 2044	1896	8de8cff82e0e362a1a19303e3455a4f89b012dd7bd00d3a3a57598c78a67d661.exe	27
PID 1896 wrote to memory of 2044	1896	8de8cff82e0e362a1a19303e3455a4f89b012dd7bd00d3a3a57598c78a67d661.exe	27

C:\Users\Admin\AppData\Local\Temp\8de8cff82e0e362a1a19303e3455a4f89b012dd7bd00d3a3a57598c78a67d661.exe
"C:\Users\Admin\AppData\Local\Temp\8de8cff82e0e362a1a19303e3455a4f89b012dd7bd00d3a3a57598c78a67d661.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 88
  2⤵
  - Program crash
  PID:2044