a0b8c8b57cebef1a3249e4c7878b786a59d692e9b07657c7988104607015b6b7

Resubmissions

31-01-2023 15:01

31-01-2023 09:27

max time kernel
38s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
31-01-2023 15:01

Target

8e0a2bc6b7cb6a2531569d25e0708df76f0ea8a2cd52bc8ab3b090e08fed319b.exe
Size

720KB
MD5

fbdd33cf51fe4113000a7fc14908b56d
SHA1

ceaf739f285eabea68567e2df0288406b3e99138
SHA256

8e0a2bc6b7cb6a2531569d25e0708df76f0ea8a2cd52bc8ab3b090e08fed319b
SHA512

f51d77cd871e69db2c082cff560fed3049b70797f862f56651cf165a34329f26257050b80417770cd6e070f2559ef976e35d324380a4f8ab1da42eca538d310b
SSDEEP

12288:aAkzqQTJ0C2Yk46NAF75VeLXoM52eVDOvvXx1I5y1wWEQnEC:aAcJ0C2Yk46NsV9M5TV0v2y1R1

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

980 1460 WerFault.exe 8e0a2bc6b7cb6a2531569d25e0708df76f0ea8a2cd52bc8ab3b090e08fed319b.exe

pid	pid_target	process	target process
980	1460	WerFault.exe	8e0a2bc6b7cb6a2531569d25e0708df76f0ea8a2cd52bc8ab3b090e08fed319b.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

8e0a2bc6b7cb6a2531569d25e0708df76f0ea8a2cd52bc8ab3b090e08fed319b.exe

description	pid	process	target process
PID 1460 wrote to memory of 980	1460	8e0a2bc6b7cb6a2531569d25e0708df76f0ea8a2cd52bc8ab3b090e08fed319b.exe	WerFault.exe
PID 1460 wrote to memory of 980	1460	8e0a2bc6b7cb6a2531569d25e0708df76f0ea8a2cd52bc8ab3b090e08fed319b.exe	WerFault.exe
PID 1460 wrote to memory of 980	1460	8e0a2bc6b7cb6a2531569d25e0708df76f0ea8a2cd52bc8ab3b090e08fed319b.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\8e0a2bc6b7cb6a2531569d25e0708df76f0ea8a2cd52bc8ab3b090e08fed319b.exe
"C:\Users\Admin\AppData\Local\Temp\8e0a2bc6b7cb6a2531569d25e0708df76f0ea8a2cd52bc8ab3b090e08fed319b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1460

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1460 -s 148
2⤵
- Program crash
PID:980