e8f9a4b0747a0508d4b2a532a63c8e87bd122247c921fdc6fc8403c65dc612a2

Analysis

max time kernel
48s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 12:36

Target

e8f9a4b0747a0508d4b2a532a63c8e87bd122247c921fdc6fc8403c65dc612a2.exe
Size

1013KB
MD5

cf76282847ffb1076672c913a60827dc
SHA1

e4270115648c4b12967281e50b1148a4347c4a31
SHA256

e8f9a4b0747a0508d4b2a532a63c8e87bd122247c921fdc6fc8403c65dc612a2
SHA512

b6dd30e01352af42ebaecb3a95c48505b5061705327ada5311a5787a45e5efad1377aa91aa1800d39d972324edb74dd400d1a972e0bbfa97071b2038437cd74e
SSDEEP

24576:8kQjEZxCrl5Fc4TBjHloiXiIdznBiNghUBsLnhZXuuuuuuuuuuuuuuuuuuuuuuu4:LxCjqFiPTkNghvhpuuuuuuuuuuuuuuu4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
628	1720	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 628	1720	e8f9a4b0747a0508d4b2a532a63c8e87bd122247c921fdc6fc8403c65dc612a2.exe	27
PID 1720 wrote to memory of 628	1720	e8f9a4b0747a0508d4b2a532a63c8e87bd122247c921fdc6fc8403c65dc612a2.exe	27
PID 1720 wrote to memory of 628	1720	e8f9a4b0747a0508d4b2a532a63c8e87bd122247c921fdc6fc8403c65dc612a2.exe	27
PID 1720 wrote to memory of 628	1720	e8f9a4b0747a0508d4b2a532a63c8e87bd122247c921fdc6fc8403c65dc612a2.exe	27

C:\Users\Admin\AppData\Local\Temp\e8f9a4b0747a0508d4b2a532a63c8e87bd122247c921fdc6fc8403c65dc612a2.exe
"C:\Users\Admin\AppData\Local\Temp\e8f9a4b0747a0508d4b2a532a63c8e87bd122247c921fdc6fc8403c65dc612a2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 188
  2⤵
  - Program crash
  PID:628

memory/1720-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/1720-56-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download