b8e0c996a4a01c044e27d004aaa350f8b4dcbd46679fbf24878dafc97dc9c484

Analysis

max time kernel
3s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 08:50

Target

b8e0c996a4a01c044e27d004aaa350f8b4dcbd46679fbf24878dafc97dc9c484.exe
Size

93KB
MD5

87a0aed1f35d6030bfe1655a951485ef
SHA1

835b29af3540e07601345871f850a33601c5e750
SHA256

b8e0c996a4a01c044e27d004aaa350f8b4dcbd46679fbf24878dafc97dc9c484
SHA512

dd3d35dbe4ada4287819534115e6c1bbb888581153e6cf5015f822c05f9fb845025780533e31336f7799784f89a7e160640a1983a7ac2c2fade2cfc889fff12b
SSDEEP

1536:y2nksHQkJfc/zhTp1Q2Z9aYREWyWU2Hd6t+w5Y8Hgly2OnYarei2el:y2ntQkFcRLQ2Z9aoKWv6QEHmy2mYarb7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1284	1352	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 1284	1352	b8e0c996a4a01c044e27d004aaa350f8b4dcbd46679fbf24878dafc97dc9c484.exe	28
PID 1352 wrote to memory of 1284	1352	b8e0c996a4a01c044e27d004aaa350f8b4dcbd46679fbf24878dafc97dc9c484.exe	28
PID 1352 wrote to memory of 1284	1352	b8e0c996a4a01c044e27d004aaa350f8b4dcbd46679fbf24878dafc97dc9c484.exe	28
PID 1352 wrote to memory of 1284	1352	b8e0c996a4a01c044e27d004aaa350f8b4dcbd46679fbf24878dafc97dc9c484.exe	28

C:\Users\Admin\AppData\Local\Temp\b8e0c996a4a01c044e27d004aaa350f8b4dcbd46679fbf24878dafc97dc9c484.exe
"C:\Users\Admin\AppData\Local\Temp\b8e0c996a4a01c044e27d004aaa350f8b4dcbd46679fbf24878dafc97dc9c484.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 92
  2⤵
  - Program crash
  PID:1284