a5a46f6dad7c86e72b9215925f32aa6047b560ad69d39afa9b472e5cfacf7bd6

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
15/01/2023, 18:47

Target

8ac7bd0c10fa6e46fb59078fc62c6387ff360b6e50bf58c5b4f8571dc7d44030.exe
Size

1.7MB
MD5

b978c2bd580e32e3b5301fbd406d240a
SHA1

2b07b9cfd341aa2d1a24af69536213a89f23bf5a
SHA256

8ac7bd0c10fa6e46fb59078fc62c6387ff360b6e50bf58c5b4f8571dc7d44030
SHA512

fa3b60fff3be0a29c2f065de723fb74c0343c628325acc0787547018366ab12204025605c661f3a0835e8c1e94ddde800cc35ed84572e9d50a225bd672b085a1
SSDEEP

49152:ufiCOQvaKSHRKpKQ7YSm1LDy649vA4LacInHIeQP:uqCTva3HYKQlm13y6MzLaNHI3P

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
956	1160	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 956	1160	8ac7bd0c10fa6e46fb59078fc62c6387ff360b6e50bf58c5b4f8571dc7d44030.exe	28
PID 1160 wrote to memory of 956	1160	8ac7bd0c10fa6e46fb59078fc62c6387ff360b6e50bf58c5b4f8571dc7d44030.exe	28
PID 1160 wrote to memory of 956	1160	8ac7bd0c10fa6e46fb59078fc62c6387ff360b6e50bf58c5b4f8571dc7d44030.exe	28
PID 1160 wrote to memory of 956	1160	8ac7bd0c10fa6e46fb59078fc62c6387ff360b6e50bf58c5b4f8571dc7d44030.exe	28

C:\Users\Admin\AppData\Local\Temp\8ac7bd0c10fa6e46fb59078fc62c6387ff360b6e50bf58c5b4f8571dc7d44030.exe
"C:\Users\Admin\AppData\Local\Temp\8ac7bd0c10fa6e46fb59078fc62c6387ff360b6e50bf58c5b4f8571dc7d44030.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 584
  2⤵
  - Program crash
  PID:956

memory/1160-54-0x00000000011F0000-0x00000000013B4000-memory.dmp

Filesize
1.8MB

Download
memory/1160-55-0x0000000007340000-0x00000000075BE000-memory.dmp

Filesize
2.5MB

Download