8909cfbce6e4388398d45bd2949d5e8a54e203d023d31605808e49aecba4e38b

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30/11/2022, 23:32

Target

8909cfbce6e4388398d45bd2949d5e8a54e203d023d31605808e49aecba4e38b.exe
Size

22KB
MD5

a8f4d16c11ce2286157b4cab2b749097
SHA1

156a786d5833e8e97e82b01ed909fe60779b6f46
SHA256

8909cfbce6e4388398d45bd2949d5e8a54e203d023d31605808e49aecba4e38b
SHA512

ebc039981b7c8008efd7d2bcf5b4fff95712a432c72810eafe1e7e220762cad6502d1fe9c7fa43f5bc2a804dbfe114607c01af553082a4237c2f97ba528601df
SSDEEP

384:Hoy9VaL4/gJOp3FDyr+EfLWoNnhkzIRdvFnS1E7DpAg2Z7+7hFJzR/2NovYZj:HVXaLv43F45WowSWKpq7+7zJzRio8j

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1224	1416	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 1224	1416	8909cfbce6e4388398d45bd2949d5e8a54e203d023d31605808e49aecba4e38b.exe	27
PID 1416 wrote to memory of 1224	1416	8909cfbce6e4388398d45bd2949d5e8a54e203d023d31605808e49aecba4e38b.exe	27
PID 1416 wrote to memory of 1224	1416	8909cfbce6e4388398d45bd2949d5e8a54e203d023d31605808e49aecba4e38b.exe	27
PID 1416 wrote to memory of 1224	1416	8909cfbce6e4388398d45bd2949d5e8a54e203d023d31605808e49aecba4e38b.exe	27

C:\Users\Admin\AppData\Local\Temp\8909cfbce6e4388398d45bd2949d5e8a54e203d023d31605808e49aecba4e38b.exe
"C:\Users\Admin\AppData\Local\Temp\8909cfbce6e4388398d45bd2949d5e8a54e203d023d31605808e49aecba4e38b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1416 -s 44
  2⤵
  - Program crash
  PID:1224