c50ec01919cac2463d4784dca41f8650a95576f5d75a90d902e6b0ab42970815

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 03:08

Target

0c8830b7936334f4c6004c9ba071fbfc.exe
Size

100KB
MD5

0c8830b7936334f4c6004c9ba071fbfc
SHA1

15a63b35138188e4a33dc0569f7d41591d8df4aa
SHA256

c50ec01919cac2463d4784dca41f8650a95576f5d75a90d902e6b0ab42970815
SHA512

b06521be92838020bc179226f66556af5c82370b785e6625ebcf7a2ba8328cf0b2add96ce23ca4bd55399e1f9e583f0e0332abce90f64146d9d6ba5ad718a44e
SSDEEP

1536:vVzozJUl0TQvyGHIHxHDyN8pk5BKt7i7glGzxn2wYJkMfCpAaEXLAc:dzGUGlWvvD2G+lfbAc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2164	2088	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2164	2088	0c8830b7936334f4c6004c9ba071fbfc.exe	28
PID 2088 wrote to memory of 2164	2088	0c8830b7936334f4c6004c9ba071fbfc.exe	28
PID 2088 wrote to memory of 2164	2088	0c8830b7936334f4c6004c9ba071fbfc.exe	28
PID 2088 wrote to memory of 2164	2088	0c8830b7936334f4c6004c9ba071fbfc.exe	28

C:\Users\Admin\AppData\Local\Temp\0c8830b7936334f4c6004c9ba071fbfc.exe
"C:\Users\Admin\AppData\Local\Temp\0c8830b7936334f4c6004c9ba071fbfc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 100
  2⤵
  - Program crash
  PID:2164

memory/2088-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2088-1-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2088-2-0x00000000001B0000-0x00000000001C6000-memory.dmp

Filesize
88KB

Download
memory/2088-3-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download