8220d4286d74f3e740925e7c0c1d583a9d6774ede3ac7f5e285458af6a9a96ca

Analysis

max time kernel
34s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 02:16

Target

8220d4286d74f3e740925e7c0c1d583a9d6774ede3ac7f5e285458af6a9a96ca.exe
Size

100KB
MD5

bcb9d1abc3645be802c19f49a27fdba9
SHA1

b7f8a79c5e6fe15820a7f24a237e271a824c34da
SHA256

8220d4286d74f3e740925e7c0c1d583a9d6774ede3ac7f5e285458af6a9a96ca
SHA512

e28cc8b58029b41c0c779cd5389307daea22855bdee6209bdd91366fca061d9b3607c9abfdb0f54b0b4f6b7f93a0c46bce4d25790ffc203977821b85ef1212b9
SSDEEP

768:Ji5Qw2B4QDHUIQgegYfyqyPhe2lVZU9QZU9w9wsMmQsIGJ5MuMXtTPaej:JiaF4MUIQLgYfylrlVzjIb1XJam

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2024	1976	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2024	1976	8220d4286d74f3e740925e7c0c1d583a9d6774ede3ac7f5e285458af6a9a96ca.exe	26
PID 1976 wrote to memory of 2024	1976	8220d4286d74f3e740925e7c0c1d583a9d6774ede3ac7f5e285458af6a9a96ca.exe	26
PID 1976 wrote to memory of 2024	1976	8220d4286d74f3e740925e7c0c1d583a9d6774ede3ac7f5e285458af6a9a96ca.exe	26
PID 1976 wrote to memory of 2024	1976	8220d4286d74f3e740925e7c0c1d583a9d6774ede3ac7f5e285458af6a9a96ca.exe	26

C:\Users\Admin\AppData\Local\Temp\8220d4286d74f3e740925e7c0c1d583a9d6774ede3ac7f5e285458af6a9a96ca.exe
"C:\Users\Admin\AppData\Local\Temp\8220d4286d74f3e740925e7c0c1d583a9d6774ede3ac7f5e285458af6a9a96ca.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 48
  2⤵
  - Program crash
  PID:2024