8265e766a588288addfed675967860065779b88905eefca9cceb89c55fdc6605

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 02:00

Target

4b2a8fceb164e2b894b74e519a0274dd.exe
Size

368KB
MD5

4b2a8fceb164e2b894b74e519a0274dd
SHA1

181a82b0a14d79ad00a6465de4a3aecb61f50dff
SHA256

8265e766a588288addfed675967860065779b88905eefca9cceb89c55fdc6605
SHA512

56952253887c3ad3516cc3b6d6359f1d2f9f58da4b8f1f9660cdd6170ab4ea773e6c8723075d634d7e928c5469ddb71de1da8c940846286d7e8d7355070957b1
SSDEEP

6144:RTAp4naqm5GR/0N4Ftn6vicI8qtQQenKDFujBeqSDgzB8jk35:R041m5Q/0N4L9xYus1NSD2Cg35

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2152	3060	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2152	3060	4b2a8fceb164e2b894b74e519a0274dd.exe	28
PID 3060 wrote to memory of 2152	3060	4b2a8fceb164e2b894b74e519a0274dd.exe	28
PID 3060 wrote to memory of 2152	3060	4b2a8fceb164e2b894b74e519a0274dd.exe	28
PID 3060 wrote to memory of 2152	3060	4b2a8fceb164e2b894b74e519a0274dd.exe	28

C:\Users\Admin\AppData\Local\Temp\4b2a8fceb164e2b894b74e519a0274dd.exe
"C:\Users\Admin\AppData\Local\Temp\4b2a8fceb164e2b894b74e519a0274dd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 116
  2⤵
  - Program crash
  PID:2152

memory/3060-0-0x0000000000AD0000-0x0000000000B30000-memory.dmp

Filesize
384KB

Download