bd8e09e3efc67e87c03467cb16133459ec2c644038cfeffb6c0c4dc4a75002d4

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27-01-2024 01:14

Target

bd8e09e3efc67e87c03467cb16133459ec2c644038cfeffb6c0c4dc4a75002d4.exe
Size

2.7MB
MD5

c1ab087afdf0e7f8f8d9ec18be3e5438
SHA1

f4f9a1b7fc9671900ca12bd51c376b19ef66b6c0
SHA256

bd8e09e3efc67e87c03467cb16133459ec2c644038cfeffb6c0c4dc4a75002d4
SHA512

239461a541d966fb981a608c5b1e83456669484ac5ade82b6052c563ffa1da5bb47a2b452e25172b32dbe289c56cce348b7e2265fde09bae4e5f847266e501fa
SSDEEP

24576:Osn9+gS6uHk1U4vHPeT97o+hzy3cHoORwqetii6hsuiWnJFN2ILSc:3LS6uH8UmGT9oHioh46

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2868 2012 WerFault.exe bd8e09e3efc67e87c03467cb16133459ec2c644038cfeffb6c0c4dc4a75002d4.exe

pid	pid_target	process	target process
2868	2012	WerFault.exe	bd8e09e3efc67e87c03467cb16133459ec2c644038cfeffb6c0c4dc4a75002d4.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

bd8e09e3efc67e87c03467cb16133459ec2c644038cfeffb6c0c4dc4a75002d4.exe

description	pid	process	target process
PID 2012 wrote to memory of 2868	2012	bd8e09e3efc67e87c03467cb16133459ec2c644038cfeffb6c0c4dc4a75002d4.exe	WerFault.exe
PID 2012 wrote to memory of 2868	2012	bd8e09e3efc67e87c03467cb16133459ec2c644038cfeffb6c0c4dc4a75002d4.exe	WerFault.exe
PID 2012 wrote to memory of 2868	2012	bd8e09e3efc67e87c03467cb16133459ec2c644038cfeffb6c0c4dc4a75002d4.exe	WerFault.exe
PID 2012 wrote to memory of 2868	2012	bd8e09e3efc67e87c03467cb16133459ec2c644038cfeffb6c0c4dc4a75002d4.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\bd8e09e3efc67e87c03467cb16133459ec2c644038cfeffb6c0c4dc4a75002d4.exe
"C:\Users\Admin\AppData\Local\Temp\bd8e09e3efc67e87c03467cb16133459ec2c644038cfeffb6c0c4dc4a75002d4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 556
2⤵
- Program crash
PID:2868

memory/2012-1-0x0000000073FA0000-0x000000007468E000-memory.dmp

Filesize
6.9MB

Download
memory/2012-0-0x0000000000BA0000-0x0000000000E54000-memory.dmp

Filesize
2.7MB

Download
memory/2012-2-0x0000000073FA0000-0x000000007468E000-memory.dmp

Filesize
6.9MB

Download