8072b75da55b6be6e3a90a0341e5763256a1bdaa898f585ad2f8c9c2358771de

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 11:24

Target

1a8ed03aca3f700693e8bf1edcdde352.exe
Size

806KB
MD5

1a8ed03aca3f700693e8bf1edcdde352
SHA1

805534fabfd117363c7b8e284878b0565c6f4f7c
SHA256

8072b75da55b6be6e3a90a0341e5763256a1bdaa898f585ad2f8c9c2358771de
SHA512

03d7a7633c76854cde5753c4746c202248b7b55c1ea7397f89d0dcdf73c95531975c403e5405feb05b7057c9419ea433516472c9aa019ece9963372f09b897cb
SSDEEP

12288:93TdtLW5WIj1YSSdFxc8FfuceqfF86K5NVazJipGmF930mSiw:lDsj1dEZgHyF86K5NMzJKG4Sl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2452	2884	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2452	2884	1a8ed03aca3f700693e8bf1edcdde352.exe	28
PID 2884 wrote to memory of 2452	2884	1a8ed03aca3f700693e8bf1edcdde352.exe	28
PID 2884 wrote to memory of 2452	2884	1a8ed03aca3f700693e8bf1edcdde352.exe	28
PID 2884 wrote to memory of 2452	2884	1a8ed03aca3f700693e8bf1edcdde352.exe	28

C:\Users\Admin\AppData\Local\Temp\1a8ed03aca3f700693e8bf1edcdde352.exe
"C:\Users\Admin\AppData\Local\Temp\1a8ed03aca3f700693e8bf1edcdde352.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 192
  2⤵
  - Program crash
  PID:2452

memory/2884-0-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2884-1-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download