eb50a8f3dd89180a5e1c699b223c8a8fdc6b7a82855e7c7a382baac9a37d8226

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
27-05-2023 01:13

Target

8685d354c551261d36d207ddc6dae473826a45b293e00244403a252f1d6059e5.exe
Size

40KB
MD5

491b72ce80b8c99d044d8a077b853616
SHA1

c1a76be5661be81b6fd255aafcbf06b1a074cad1
SHA256

8685d354c551261d36d207ddc6dae473826a45b293e00244403a252f1d6059e5
SHA512

7e4b3f473ef4c697a1d965af5b99ebe2a4481d586458d4dbbea4062d40c93ab100b586da8b207af2cf10eed78e2694fca14838e42d6880e0b8f1dfa0c6fa914a
SSDEEP

96:nPvruCtimr49AKTaZh5HFloWGa1EwpDCxRjoSjTHmqEIyBrmPsWWA:nbuCtr49AKTaZpdGcEwpux6tIyByW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2016	1048	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 2016	1048	8685d354c551261d36d207ddc6dae473826a45b293e00244403a252f1d6059e5.exe	28
PID 1048 wrote to memory of 2016	1048	8685d354c551261d36d207ddc6dae473826a45b293e00244403a252f1d6059e5.exe	28
PID 1048 wrote to memory of 2016	1048	8685d354c551261d36d207ddc6dae473826a45b293e00244403a252f1d6059e5.exe	28
PID 1048 wrote to memory of 2016	1048	8685d354c551261d36d207ddc6dae473826a45b293e00244403a252f1d6059e5.exe	28

C:\Users\Admin\AppData\Local\Temp\8685d354c551261d36d207ddc6dae473826a45b293e00244403a252f1d6059e5.exe
"C:\Users\Admin\AppData\Local\Temp\8685d354c551261d36d207ddc6dae473826a45b293e00244403a252f1d6059e5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 36
  2⤵
  - Program crash
  PID:2016