04dd534c167bdd1d280575a4c13aec0f534dafb788b0e1c1839abb55f2097f16

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02-02-2023 13:40

Target

e8d00f72f770cc2b20a1c15c57286c8d2d000afe.exe
Size

32KB
MD5

3f0d36f275004ec5a9b6d2b9b7e5ffe1
SHA1

e8d00f72f770cc2b20a1c15c57286c8d2d000afe
SHA256

04dd534c167bdd1d280575a4c13aec0f534dafb788b0e1c1839abb55f2097f16
SHA512

c7adfeca180194666ad99c5058be9eb11c150f6ece889672a5bf09f270ff7662e9e1868c6a49545e3dafc94da0d8b7fa2c9d236d94e713c3720bb2ce60d4c5a8
SSDEEP

384:HehtwzTz02KIRPIScRhlso0I/eg71zyPpLOSKFhzyb6fcTXocNcFb5zEB:+h67rRP6hz058sp8zybfYcIb5z

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1668	1244	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 1668	1244	e8d00f72f770cc2b20a1c15c57286c8d2d000afe.exe	28
PID 1244 wrote to memory of 1668	1244	e8d00f72f770cc2b20a1c15c57286c8d2d000afe.exe	28
PID 1244 wrote to memory of 1668	1244	e8d00f72f770cc2b20a1c15c57286c8d2d000afe.exe	28
PID 1244 wrote to memory of 1668	1244	e8d00f72f770cc2b20a1c15c57286c8d2d000afe.exe	28

C:\Users\Admin\AppData\Local\Temp\e8d00f72f770cc2b20a1c15c57286c8d2d000afe.exe
"C:\Users\Admin\AppData\Local\Temp\e8d00f72f770cc2b20a1c15c57286c8d2d000afe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 88
  2⤵
  - Program crash
  PID:1668

memory/1244-55-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1668-54-0x0000000000000000-mapping.dmp

Download