f8c5623bffac78da403951b30ff5b0f7928030d90cbbdd2159f7500e9e52d1c9

Analysis

max time kernel
45s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 05:43

Target

f8c5623bffac78da403951b30ff5b0f7928030d90cbbdd2159f7500e9e52d1c9.exe
Size

51KB
MD5

03bbde4cbeda0f0dd38e2cdbe0b5cdbf
SHA1

925ed9c615756f1e601a7e74f7187239680fb4bf
SHA256

f8c5623bffac78da403951b30ff5b0f7928030d90cbbdd2159f7500e9e52d1c9
SHA512

e48ddbce9c14ac412a10cc861fbce7c55ebe4652892a4b18ca53372158d31a834b2194edd25bb02e83298ffc854367b32f3455cd85c49116062d66f7d9c5ebfc
SSDEEP

768:h9X973rdzh7B1t4tQqKQCil2/nzB4m9mCzesTAcbc6PYNArwH:drWCws/nSmleEAcwCYOro

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1980	2024	WerFault.exe	20

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 1980	2024	f8c5623bffac78da403951b30ff5b0f7928030d90cbbdd2159f7500e9e52d1c9.exe	28
PID 2024 wrote to memory of 1980	2024	f8c5623bffac78da403951b30ff5b0f7928030d90cbbdd2159f7500e9e52d1c9.exe	28
PID 2024 wrote to memory of 1980	2024	f8c5623bffac78da403951b30ff5b0f7928030d90cbbdd2159f7500e9e52d1c9.exe	28
PID 2024 wrote to memory of 1980	2024	f8c5623bffac78da403951b30ff5b0f7928030d90cbbdd2159f7500e9e52d1c9.exe	28

C:\Users\Admin\AppData\Local\Temp\f8c5623bffac78da403951b30ff5b0f7928030d90cbbdd2159f7500e9e52d1c9.exe
"C:\Users\Admin\AppData\Local\Temp\f8c5623bffac78da403951b30ff5b0f7928030d90cbbdd2159f7500e9e52d1c9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 88
  2⤵
  - Program crash
  PID:1980

memory/2024-54-0x0000000000300000-0x00000000003AC000-memory.dmp

Filesize
688KB

Download
memory/2024-56-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download