b371876966acd582acbf6c16932df45178b541a8cd6923ff52e3da904af5da16

Analysis

max time kernel
21s
max time network
32s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
08/07/2023, 17:25

Target

8ec1146ab92212exeexeexeex.exe
Size

178KB
MD5

8ec1146ab92212ff609089fc34282c43
SHA1

057e4685c504b6360a2d9c79c04b5b3528022a53
SHA256

b371876966acd582acbf6c16932df45178b541a8cd6923ff52e3da904af5da16
SHA512

e89b31a600d4f626f58d777fcd0fe234b58e915df6877290baf83a57870254f14e3b815ea7531c5b010b17d4c3053fcbf2b28160ac17f48fe0a50ad8c1859208
SSDEEP

3072:HyGKQ8XR4QsAlkAORfDMehub/yd0ehklxjqfubdVp9+EWI7M:DKvBJleRfDMe7d0ehlidQX0M

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1144	1152	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 1144	1152	8ec1146ab92212exeexeexeex.exe	29
PID 1152 wrote to memory of 1144	1152	8ec1146ab92212exeexeexeex.exe	29
PID 1152 wrote to memory of 1144	1152	8ec1146ab92212exeexeexeex.exe	29
PID 1152 wrote to memory of 1144	1152	8ec1146ab92212exeexeexeex.exe	29

C:\Users\Admin\AppData\Local\Temp\8ec1146ab92212exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\8ec1146ab92212exeexeexeex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 36
  2⤵
  - Program crash
  PID:1144

memory/1152-54-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download