c8fa736a4be2f8ada26d90d8ba5b86f1e34b1e012051469095d1315fa150878a

Analysis

max time kernel
53s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 06:03

Target

c8fa736a4be2f8ada26d90d8ba5b86f1e34b1e012051469095d1315fa150878a.exe
Size

54KB
MD5

fb88c73f699599dea38612b66acbe047
SHA1

5f13866de7ee3489d02a214647da8bf06dfd065e
SHA256

c8fa736a4be2f8ada26d90d8ba5b86f1e34b1e012051469095d1315fa150878a
SHA512

2df0d953c61b01edde7a55dca889b8013f398dc3d58e6b797460a5515657f4eefac067865b24b6a6ade9b1da756967c0d0fe98013726d9d7f037992838442547
SSDEEP

1536:jwChaLue646cIBXA8Y5rLGBPZDCkgNlvGFyf:PELue646DJbULCZ7MpEyf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
328	1968	WerFault.exe	19

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 328	1968	c8fa736a4be2f8ada26d90d8ba5b86f1e34b1e012051469095d1315fa150878a.exe	28
PID 1968 wrote to memory of 328	1968	c8fa736a4be2f8ada26d90d8ba5b86f1e34b1e012051469095d1315fa150878a.exe	28
PID 1968 wrote to memory of 328	1968	c8fa736a4be2f8ada26d90d8ba5b86f1e34b1e012051469095d1315fa150878a.exe	28
PID 1968 wrote to memory of 328	1968	c8fa736a4be2f8ada26d90d8ba5b86f1e34b1e012051469095d1315fa150878a.exe	28

C:\Users\Admin\AppData\Local\Temp\c8fa736a4be2f8ada26d90d8ba5b86f1e34b1e012051469095d1315fa150878a.exe
"C:\Users\Admin\AppData\Local\Temp\c8fa736a4be2f8ada26d90d8ba5b86f1e34b1e012051469095d1315fa150878a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 172
  2⤵
  - Program crash
  PID:328

memory/1968-54-0x0000000075761000-0x0000000075763000-memory.dmp

Filesize
8KB

Download
memory/1968-55-0x00000000008A0000-0x0000000000997000-memory.dmp

Filesize
988KB

Download
memory/1968-56-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download
memory/1968-57-0x00000000008A0000-0x0000000000997000-memory.dmp

Filesize
988KB

Download
memory/1968-65-0x00000000008A0000-0x0000000000997000-memory.dmp

Filesize
988KB

Download