ef01b04a82e39311f276fcfec11bdc62fe6fb8f86a41610a5a8d15503a7d01fa

Analysis

max time kernel
142s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 00:26

Target

08849310a345d900e1a41d44565bb53b.exe
Size

24KB
MD5

08849310a345d900e1a41d44565bb53b
SHA1

bb06997ece2bee4878f38e2b1988d696531dd1f2
SHA256

ef01b04a82e39311f276fcfec11bdc62fe6fb8f86a41610a5a8d15503a7d01fa
SHA512

134687afb2b50007efbb333581995eaf2ff6be47784d6cf0d19c9a793233d41e50aa8dd4d6deebf87df0fe4538c664598502f1673dcb236ae7f06bc3ebe2ff98
SSDEEP

384:sekWoyxjzmUzU6Gc2Cv4Az8MMsNGZ9T2CEPqs5wGBm1z9/:PVz7sc2C98MZ0f2CEPc/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2712	2780	WerFault.exe	27

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2692	2780	08849310a345d900e1a41d44565bb53b.exe	28
PID 2780 wrote to memory of 2692	2780	08849310a345d900e1a41d44565bb53b.exe	28
PID 2780 wrote to memory of 2692	2780	08849310a345d900e1a41d44565bb53b.exe	28
PID 2780 wrote to memory of 2692	2780	08849310a345d900e1a41d44565bb53b.exe	28
PID 2780 wrote to memory of 2712	2780	08849310a345d900e1a41d44565bb53b.exe	29
PID 2780 wrote to memory of 2712	2780	08849310a345d900e1a41d44565bb53b.exe	29
PID 2780 wrote to memory of 2712	2780	08849310a345d900e1a41d44565bb53b.exe	29
PID 2780 wrote to memory of 2712	2780	08849310a345d900e1a41d44565bb53b.exe	29

C:\Users\Admin\AppData\Local\Temp\08849310a345d900e1a41d44565bb53b.exe
"C:\Users\Admin\AppData\Local\Temp\08849310a345d900e1a41d44565bb53b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Users\Admin\AppData\Local\Temp\08849310a345d900e1a41d44565bb53b.exe
  "C:\Users\Admin\AppData\Local\Temp\08849310a345d900e1a41d44565bb53b.exe"
  2⤵
  PID:2692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 92
  2⤵
  - Program crash
  PID:2712

memory/2780-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download