80faaac6b6143417930b518a06e65058e5bf8ce98b83607b331e56cfd9037d78

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
08/06/2023, 21:45

Target

80faaac6b6143417930b518a06e65058e5bf8ce98b83607b331e56cfd9037d78.exe
Size

643KB
MD5

d3087add2c527081fa81a320b10648c4
SHA1

69dca406f6482f23e3453a4d258aa398d0f788cb
SHA256

80faaac6b6143417930b518a06e65058e5bf8ce98b83607b331e56cfd9037d78
SHA512

09e36ea98c94abc2cb36c6bca42c6ff00f9f946d7e6271e5ab6de671273329d5a34430a8242da7f85377c8486f8db72cb8d899fbff3fb7a04fd304cea856bb7b
SSDEEP

12288:t9AWz02d3OVC+Ot1hCf1A5Ygna+E78r2Dor6UOQAJ92XH0niZRzSS:t9JJd3n+Otv2K5iP7iMor6MA96H0n/S

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1980	1108	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 1980	1108	80faaac6b6143417930b518a06e65058e5bf8ce98b83607b331e56cfd9037d78.exe	27
PID 1108 wrote to memory of 1980	1108	80faaac6b6143417930b518a06e65058e5bf8ce98b83607b331e56cfd9037d78.exe	27
PID 1108 wrote to memory of 1980	1108	80faaac6b6143417930b518a06e65058e5bf8ce98b83607b331e56cfd9037d78.exe	27
PID 1108 wrote to memory of 1980	1108	80faaac6b6143417930b518a06e65058e5bf8ce98b83607b331e56cfd9037d78.exe	27

C:\Users\Admin\AppData\Local\Temp\80faaac6b6143417930b518a06e65058e5bf8ce98b83607b331e56cfd9037d78.exe
"C:\Users\Admin\AppData\Local\Temp\80faaac6b6143417930b518a06e65058e5bf8ce98b83607b331e56cfd9037d78.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 232
  2⤵
  - Program crash
  PID:1980