f3809eed8c6490f0e42711041dd0d7610ffc043759df52c873184052e36e2af1

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/02/2023, 19:23

Target

a8bb4191a8a0dea730def8254967c80db1c2b7d7.exe
Size

37KB
MD5

0a25dd5660057eb8fa23b8d57d1d4708
SHA1

a8bb4191a8a0dea730def8254967c80db1c2b7d7
SHA256

f3809eed8c6490f0e42711041dd0d7610ffc043759df52c873184052e36e2af1
SHA512

d07d53502f08ccf6662ad85155bac26f109fa2db3d01540370597f25641661212c7a65f6d67b2b49e790e3500dc8506aac59f1c58d926f579d4a3e4348bebb7a
SSDEEP

768:fevwNGja1TxGIP+tZSPXLgF43rt+cY/qt5RYVMyc/U24v:fNG21T4IP+tZKX8iJ+xqtfYzcr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
728	1236	WerFault.exe	25

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 728	1236	a8bb4191a8a0dea730def8254967c80db1c2b7d7.exe	26
PID 1236 wrote to memory of 728	1236	a8bb4191a8a0dea730def8254967c80db1c2b7d7.exe	26
PID 1236 wrote to memory of 728	1236	a8bb4191a8a0dea730def8254967c80db1c2b7d7.exe	26

C:\Users\Admin\AppData\Local\Temp\a8bb4191a8a0dea730def8254967c80db1c2b7d7.exe
"C:\Users\Admin\AppData\Local\Temp\a8bb4191a8a0dea730def8254967c80db1c2b7d7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1236 -s 716
  2⤵
  - Program crash
  PID:728

memory/1236-54-0x0000000000800000-0x000000000080E000-memory.dmp

Filesize
56KB

Download
memory/1236-55-0x000007FEFBAE1000-0x000007FEFBAE3000-memory.dmp

Filesize
8KB

Download