e8dab4311449337518fd2264bebfaa3f89ecbd1350b4df5374d2907791dc938c

Analysis

max time kernel
225s
max time network
335s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 15:54

Target

e8dab4311449337518fd2264bebfaa3f89ecbd1350b4df5374d2907791dc938c.exe
Size

72KB
MD5

2833410dd424a5bcf73715384bf905f7
SHA1

3a8eb284ee4bf8b926eee21aff70501b8a349e4c
SHA256

e8dab4311449337518fd2264bebfaa3f89ecbd1350b4df5374d2907791dc938c
SHA512

8e91fe147bb09ce038e6cc6b33f4b50b4c49d1fb13430e09828ee1001ec493bb128e77d5a8022da0eb436e1cacf17119dde1580e3507b51e3ad17520d0c45ea8
SSDEEP

768:nx+bxsRMyTJZoPekcHSA8Go8FIWhsdCx4UTeZC4m7e0reVRN7AhGfh:nxgxsRMyTCekQNofWDxbJrk/7gGJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
664	584	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 584 wrote to memory of 664	584	e8dab4311449337518fd2264bebfaa3f89ecbd1350b4df5374d2907791dc938c.exe	28
PID 584 wrote to memory of 664	584	e8dab4311449337518fd2264bebfaa3f89ecbd1350b4df5374d2907791dc938c.exe	28
PID 584 wrote to memory of 664	584	e8dab4311449337518fd2264bebfaa3f89ecbd1350b4df5374d2907791dc938c.exe	28
PID 584 wrote to memory of 664	584	e8dab4311449337518fd2264bebfaa3f89ecbd1350b4df5374d2907791dc938c.exe	28

C:\Users\Admin\AppData\Local\Temp\e8dab4311449337518fd2264bebfaa3f89ecbd1350b4df5374d2907791dc938c.exe
"C:\Users\Admin\AppData\Local\Temp\e8dab4311449337518fd2264bebfaa3f89ecbd1350b4df5374d2907791dc938c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 584 -s 36
  2⤵
  - Program crash
  PID:664

memory/584-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download