b8d0fd3eaf3a61b19746665159dfbd034fc48ad4e1c49e2abcb505cde98c09d9

Analysis

max time kernel
37s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 13:07

Target

b8d0fd3eaf3a61b19746665159dfbd034fc48ad4e1c49e2abcb505cde98c09d9.exe
Size

208KB
MD5

8c4c4df5be851e1e5c9d8485736718ee
SHA1

8580e128f990db16ac024da47e054f4170ff1bb3
SHA256

b8d0fd3eaf3a61b19746665159dfbd034fc48ad4e1c49e2abcb505cde98c09d9
SHA512

8c79d20e9c43c7a4696401ddf79d4848b58915c9d532bf13cbed6d780ae160b9cde81e21ae52affa49e9f2db20279b3d097f1c77fedbaf984da89e4208bef0f6
SSDEEP

6144:BmFvrOvTQeULxHm6/vPVtoub3qbP1t0Fc2:cZrObQeUtHmQvLoSqL1t0Fc2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1156	1408	WerFault.exe	13

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 1156	1408	b8d0fd3eaf3a61b19746665159dfbd034fc48ad4e1c49e2abcb505cde98c09d9.exe	26
PID 1408 wrote to memory of 1156	1408	b8d0fd3eaf3a61b19746665159dfbd034fc48ad4e1c49e2abcb505cde98c09d9.exe	26
PID 1408 wrote to memory of 1156	1408	b8d0fd3eaf3a61b19746665159dfbd034fc48ad4e1c49e2abcb505cde98c09d9.exe	26
PID 1408 wrote to memory of 1156	1408	b8d0fd3eaf3a61b19746665159dfbd034fc48ad4e1c49e2abcb505cde98c09d9.exe	26

C:\Users\Admin\AppData\Local\Temp\b8d0fd3eaf3a61b19746665159dfbd034fc48ad4e1c49e2abcb505cde98c09d9.exe
"C:\Users\Admin\AppData\Local\Temp\b8d0fd3eaf3a61b19746665159dfbd034fc48ad4e1c49e2abcb505cde98c09d9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 136
  2⤵
  - Program crash
  PID:1156