4e8e608d212e97941a44ee703ca97aab14a6c0b6b8b1837ae3a997c8db2d85bc

Analysis

max time kernel
119s
max time network
137s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
14/11/2023, 19:53

Target

4e8e608d212e97941a44ee703ca97aab14a6c0b6b8b1837ae3a997c8db2d85bc.exe
Size

12.4MB
MD5

2ce5d67bc0fcd41bd6b443982df6d863
SHA1

9ea6c283da80bb0a335606fd2141d9575f54b03d
SHA256

4e8e608d212e97941a44ee703ca97aab14a6c0b6b8b1837ae3a997c8db2d85bc
SHA512

d112218c03017938243fc6b22745448659b1b97cbb3b5fbea2e779f5cf2ad3c78f4d0344d0306e6ebffbcd72bdac3dd04ef15ff23f93041736eeddbbcca03062
SSDEEP

196608:VhtV8Mu+slScHkZugNZ1KpdqC7MRPOZBpabcGsEnspyzkZwSb0tFExvL61qvxV6z:3fEiNwn57M4HNEn+ygKzExvL61M

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2328	2412	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2328	2412	4e8e608d212e97941a44ee703ca97aab14a6c0b6b8b1837ae3a997c8db2d85bc.exe	28
PID 2412 wrote to memory of 2328	2412	4e8e608d212e97941a44ee703ca97aab14a6c0b6b8b1837ae3a997c8db2d85bc.exe	28
PID 2412 wrote to memory of 2328	2412	4e8e608d212e97941a44ee703ca97aab14a6c0b6b8b1837ae3a997c8db2d85bc.exe	28
PID 2412 wrote to memory of 2328	2412	4e8e608d212e97941a44ee703ca97aab14a6c0b6b8b1837ae3a997c8db2d85bc.exe	28

C:\Users\Admin\AppData\Local\Temp\4e8e608d212e97941a44ee703ca97aab14a6c0b6b8b1837ae3a997c8db2d85bc.exe
"C:\Users\Admin\AppData\Local\Temp\4e8e608d212e97941a44ee703ca97aab14a6c0b6b8b1837ae3a997c8db2d85bc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 304
  2⤵
  - Program crash
  PID:2328

memory/2412-0-0x0000000000400000-0x0000000001546000-memory.dmp

Filesize
17.3MB

Download
memory/2412-1-0x0000000005EA0000-0x0000000006262000-memory.dmp

Filesize
3.8MB

Download
memory/2412-3-0x0000000005EA0000-0x0000000006262000-memory.dmp

Filesize
3.8MB

Download
memory/2412-6-0x0000000005EA0000-0x0000000006262000-memory.dmp

Filesize
3.8MB

Download
memory/2412-10-0x0000000005EA0000-0x0000000006262000-memory.dmp

Filesize
3.8MB

Download
memory/2412-14-0x0000000005EA0000-0x0000000006262000-memory.dmp

Filesize
3.8MB

Download
memory/2412-18-0x0000000005EA0000-0x0000000006262000-memory.dmp

Filesize
3.8MB

Download
memory/2412-22-0x0000000005EA0000-0x0000000006262000-memory.dmp

Filesize
3.8MB

Download
memory/2412-25-0x0000000005EA0000-0x0000000006262000-memory.dmp

Filesize
3.8MB

Download
memory/2412-26-0x0000000005EA0000-0x0000000006262000-memory.dmp

Filesize
3.8MB

Download
memory/2412-27-0x0000000005EA0000-0x0000000006262000-memory.dmp

Filesize
3.8MB

Download
memory/2412-28-0x0000000000400000-0x0000000001546000-memory.dmp

Filesize
17.3MB

Download