8f08d2b6ad5330b27aa4b0f14b97c632c47b3d0775104f4c5d892be3d8f085c7

Analysis

max time kernel
122s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 07:57

Target

5002e1c7e9634d0736fbf5155e6b39fd.exe
Size

10KB
MD5

5002e1c7e9634d0736fbf5155e6b39fd
SHA1

6bb669a8c340165f6fa1bb3ecdf11119d22601a6
SHA256

8f08d2b6ad5330b27aa4b0f14b97c632c47b3d0775104f4c5d892be3d8f085c7
SHA512

7cab20267230ffee3bcfcd6129027a0f35e68690825aa4c6898e774b0c1d938683d7a365afd8119e4007cd42bd970bf054599cfc3987acc534001540f62deda8
SSDEEP

192:Up8azG7ITJLC2v/EFwdA9FMtI5hxq/M+V6Oy//jNM8gmgsIwRtcKp:iLzoIHE3MmNqt8OynjTs6mKp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1708	1544	WerFault.exe	24

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 1708	1544	5002e1c7e9634d0736fbf5155e6b39fd.exe	28
PID 1544 wrote to memory of 1708	1544	5002e1c7e9634d0736fbf5155e6b39fd.exe	28
PID 1544 wrote to memory of 1708	1544	5002e1c7e9634d0736fbf5155e6b39fd.exe	28
PID 1544 wrote to memory of 1708	1544	5002e1c7e9634d0736fbf5155e6b39fd.exe	28

C:\Users\Admin\AppData\Local\Temp\5002e1c7e9634d0736fbf5155e6b39fd.exe
"C:\Users\Admin\AppData\Local\Temp\5002e1c7e9634d0736fbf5155e6b39fd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 88
  2⤵
  - Program crash
  PID:1708