88a3b41a55f81d44834d3867f56993ea03cccd26f0878d17b117faf3f17ac501

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
02-03-2023 15:14

Target

88a3b41a55f81d44834d3867f56993ea03cccd26f0878d17b117faf3f17ac501.exe
Size

580KB
MD5

8a45293860c097c76de004e96bfe677a
SHA1

30956427a90f594f9411fa65732a653d2f562602
SHA256

88a3b41a55f81d44834d3867f56993ea03cccd26f0878d17b117faf3f17ac501
SHA512

8a8b4182c9bfb5130971b36535a0ee56ec49200315f0290a82f7d691bd8c37db887889b45988e41a2fef796415c57d4b8246dd5a80cfa96ca63094068a8d98f5
SSDEEP

12288:r8Malpp/QPcqcGVwwAPfoEQB94Uc1VNzZWPx9HBKlTdb:r8dhQEqcGQfoxGVxIP/Itd

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1252 832 WerFault.exe 88a3b41a55f81d44834d3867f56993ea03cccd26f0878d17b117faf3f17ac501.exe

pid	pid_target	process	target process
1252	832	WerFault.exe	88a3b41a55f81d44834d3867f56993ea03cccd26f0878d17b117faf3f17ac501.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

88a3b41a55f81d44834d3867f56993ea03cccd26f0878d17b117faf3f17ac501.exe

description	pid	process	target process
PID 832 wrote to memory of 1252	832	88a3b41a55f81d44834d3867f56993ea03cccd26f0878d17b117faf3f17ac501.exe	WerFault.exe
PID 832 wrote to memory of 1252	832	88a3b41a55f81d44834d3867f56993ea03cccd26f0878d17b117faf3f17ac501.exe	WerFault.exe
PID 832 wrote to memory of 1252	832	88a3b41a55f81d44834d3867f56993ea03cccd26f0878d17b117faf3f17ac501.exe	WerFault.exe
PID 832 wrote to memory of 1252	832	88a3b41a55f81d44834d3867f56993ea03cccd26f0878d17b117faf3f17ac501.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\88a3b41a55f81d44834d3867f56993ea03cccd26f0878d17b117faf3f17ac501.exe
"C:\Users\Admin\AppData\Local\Temp\88a3b41a55f81d44834d3867f56993ea03cccd26f0878d17b117faf3f17ac501.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 832 -s 184
2⤵
- Program crash
PID:1252