8f07e6a0d628c84a5ddb206142ea3ede49fc6cbbae91f450aabf8c982847932f

Analysis

max time kernel
233s
max time network
337s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
07/12/2022, 03:47

Target

8f07e6a0d628c84a5ddb206142ea3ede49fc6cbbae91f450aabf8c982847932f.exe
Size

124KB
MD5

f3e0ed2712d214c62ff14806314a48bd
SHA1

dbda7de1c43fb689424e7d0d5ebfd11bd43eb873
SHA256

8f07e6a0d628c84a5ddb206142ea3ede49fc6cbbae91f450aabf8c982847932f
SHA512

33f9dbbcd2ff42d4c2c21b77a0760c04933b610a8f992554f0c2f8f94ffc48e30eb8f53e152e3d6e95ad4ae1ba1a0b102852de567c4957cd7f8b7d119f80ad6f
SSDEEP

1536:p65EjgBYf5QSTYM96E/t6lycmYtXcxQLdXHRqZ8m69CWcUJ5yeeAi6zMd5y3pZv:gi+gQSTYM9dvc9BhvLjJEee44K3pZv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
620	828	WerFault.exe	20

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 620	828	8f07e6a0d628c84a5ddb206142ea3ede49fc6cbbae91f450aabf8c982847932f.exe	28
PID 828 wrote to memory of 620	828	8f07e6a0d628c84a5ddb206142ea3ede49fc6cbbae91f450aabf8c982847932f.exe	28
PID 828 wrote to memory of 620	828	8f07e6a0d628c84a5ddb206142ea3ede49fc6cbbae91f450aabf8c982847932f.exe	28
PID 828 wrote to memory of 620	828	8f07e6a0d628c84a5ddb206142ea3ede49fc6cbbae91f450aabf8c982847932f.exe	28

C:\Users\Admin\AppData\Local\Temp\8f07e6a0d628c84a5ddb206142ea3ede49fc6cbbae91f450aabf8c982847932f.exe
"C:\Users\Admin\AppData\Local\Temp\8f07e6a0d628c84a5ddb206142ea3ede49fc6cbbae91f450aabf8c982847932f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 92
  2⤵
  - Program crash
  PID:620