b0adaaf0affdf6a04b29db623f74030a5b7e43b238f1d51cc720baaa1bb4963f

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 07:47

Target

e8c962d87fc05c1dadc2db822ef174c73f02754271f563a5e1e83d0ebd08528c.exe
Size

408KB
MD5

3b8e7fa4a1310534e87c342dd2d810e2
SHA1

ffe4f11e07120fd6614b555707ae13670f8301f5
SHA256

e8c962d87fc05c1dadc2db822ef174c73f02754271f563a5e1e83d0ebd08528c
SHA512

b7774aa680ac8722391a5b3696b6048fa9c82cbeb5596bce6b4bd99a35e8ddf229302af5c32df11dad9deb47210084b03cbe101fe2c376a3ed162af063ee7d83
SSDEEP

12288:fRsXXRYJNDOIUuyoWxgXa/jkrX6ZysBfBd3V7Dsw:fR1XFUuDsgXa/jkrX6YwBdq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2652	2456	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 2652	2456	e8c962d87fc05c1dadc2db822ef174c73f02754271f563a5e1e83d0ebd08528c.exe	28
PID 2456 wrote to memory of 2652	2456	e8c962d87fc05c1dadc2db822ef174c73f02754271f563a5e1e83d0ebd08528c.exe	28
PID 2456 wrote to memory of 2652	2456	e8c962d87fc05c1dadc2db822ef174c73f02754271f563a5e1e83d0ebd08528c.exe	28
PID 2456 wrote to memory of 2652	2456	e8c962d87fc05c1dadc2db822ef174c73f02754271f563a5e1e83d0ebd08528c.exe	28

C:\Users\Admin\AppData\Local\Temp\e8c962d87fc05c1dadc2db822ef174c73f02754271f563a5e1e83d0ebd08528c.exe
"C:\Users\Admin\AppData\Local\Temp\e8c962d87fc05c1dadc2db822ef174c73f02754271f563a5e1e83d0ebd08528c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 768
  2⤵
  - Program crash
  PID:2652