436b663b26617b3c104bebabfad58f40e5089fb9be144b9d5532b0ec6867dd4c

Analysis

max time kernel
71s
max time network
76s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
09-07-2023 16:08

Target

8b7caa23b1aeeaexeexeexeex.exe
Size

335KB
MD5

8b7caa23b1aeea7c37219dce13f9a1a7
SHA1

f1af051fa9cceb918661e059c3494aa1b4e48333
SHA256

436b663b26617b3c104bebabfad58f40e5089fb9be144b9d5532b0ec6867dd4c
SHA512

5eafdefecd6d34e4e4ab51c506aa47a49e19ab4c33c17befa1894bff3ed734259249ade093daa5e2f7f7b8aa7427f609fcd411188787e038f02ee20f0911900f
SSDEEP

6144:qtUGfUWOeEBUEhLkXj3zRG6yLQ/UNP4H2CiTTf10qhh4+Ajrt:qtUGfVwUFzRG6EQ0POfiTT90qjAjrt

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2420 2364 WerFault.exe 8b7caa23b1aeeaexeexeexeex.exe

pid	pid_target	process	target process
2420	2364	WerFault.exe	8b7caa23b1aeeaexeexeexeex.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8b7caa23b1aeeaexeexeexeex.exe

description	pid	process	target process
PID 2364 wrote to memory of 2420	2364	8b7caa23b1aeeaexeexeexeex.exe	WerFault.exe
PID 2364 wrote to memory of 2420	2364	8b7caa23b1aeeaexeexeexeex.exe	WerFault.exe
PID 2364 wrote to memory of 2420	2364	8b7caa23b1aeeaexeexeexeex.exe	WerFault.exe
PID 2364 wrote to memory of 2420	2364	8b7caa23b1aeeaexeexeexeex.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\8b7caa23b1aeeaexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\8b7caa23b1aeeaexeexeexeex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 120
2⤵
- Program crash
PID:2420