8fc0fa7eebb1017436a326b914208903491a47451ab84a952e5fddd7a110d9f6

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 10:44

Target

164b0c7b4aa704c0195d697c2c96b2f7.exe
Size

722KB
MD5

164b0c7b4aa704c0195d697c2c96b2f7
SHA1

3588c96a323871b8a7f070dabdb9bac6068ba804
SHA256

8fc0fa7eebb1017436a326b914208903491a47451ab84a952e5fddd7a110d9f6
SHA512

caef900bc5b507a6c0d6f3ca10537c1c9872fd4daa79e700fa7bb39dd3aa8cbaf8ac1aabefeefc61d2157d4f3aa2b5eb52bf67035e2eb51eb3bd9e244e623f17
SSDEEP

12288:a5OxgcIVe0XfojfeokI+FloVPDkfdjfEYpda123MMXm1j1WWoPeeyORz4P:aIxAPoTvAFlGkjfC1237WZAPe5+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
1420	1764	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 1420	1764	164b0c7b4aa704c0195d697c2c96b2f7.exe	14
PID 1764 wrote to memory of 1420	1764	164b0c7b4aa704c0195d697c2c96b2f7.exe	14
PID 1764 wrote to memory of 1420	1764	164b0c7b4aa704c0195d697c2c96b2f7.exe	14
PID 1764 wrote to memory of 1420	1764	164b0c7b4aa704c0195d697c2c96b2f7.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 180
1⤵
- Program crash
PID:1420

C:\Users\Admin\AppData\Local\Temp\164b0c7b4aa704c0195d697c2c96b2f7.exe
"C:\Users\Admin\AppData\Local\Temp\164b0c7b4aa704c0195d697c2c96b2f7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1764

memory/1764-1-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download