8c04f3ded8a63faf96c3380f02297ebbd54fafb9e7ce015373d349e93cb45a23

Analysis

max time kernel
26s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 21:27

Target

8c04f3ded8a63faf96c3380f02297ebbd54fafb9e7ce015373d349e93cb45a23.exe
Size

26KB
MD5

80af43646b74d29574bd2add5a2e995c
SHA1

5c893d0b0008c4378402fb5e7ff4fb951fe7fe48
SHA256

8c04f3ded8a63faf96c3380f02297ebbd54fafb9e7ce015373d349e93cb45a23
SHA512

6d8290ff0681888777299f8796f0a098b3343b8052770ee77ec1c237f1f505b66281e02ee1efbb9101740b96ac106d7ffd08996b624694aa032a5291328aa679
SSDEEP

768:gKIrKh6QoRM9WtpHlKzmh2KqT2J15iJEYYbaofSuZ5:5I2ADpwmQKqT2J15iJ9YbaYSuZ5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1516	1620	WerFault.exe	8

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 1516	1620	8c04f3ded8a63faf96c3380f02297ebbd54fafb9e7ce015373d349e93cb45a23.exe	28
PID 1620 wrote to memory of 1516	1620	8c04f3ded8a63faf96c3380f02297ebbd54fafb9e7ce015373d349e93cb45a23.exe	28
PID 1620 wrote to memory of 1516	1620	8c04f3ded8a63faf96c3380f02297ebbd54fafb9e7ce015373d349e93cb45a23.exe	28
PID 1620 wrote to memory of 1516	1620	8c04f3ded8a63faf96c3380f02297ebbd54fafb9e7ce015373d349e93cb45a23.exe	28

C:\Users\Admin\AppData\Local\Temp\8c04f3ded8a63faf96c3380f02297ebbd54fafb9e7ce015373d349e93cb45a23.exe
"C:\Users\Admin\AppData\Local\Temp\8c04f3ded8a63faf96c3380f02297ebbd54fafb9e7ce015373d349e93cb45a23.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 184
  2⤵
  - Program crash
  PID:1516

memory/1620-54-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/1620-56-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download