f8c50f0a2804cd25520d3ea9f28892a7405ab1e6e0319bfb1802202a7b96af52

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 02:32

Target

f8c50f0a2804cd25520d3ea9f28892a7405ab1e6e0319bfb1802202a7b96af52.exe
Size

5KB
MD5

c7634f4e3a835d00abd3dc5d6db8d348
SHA1

3b3a60b96aa1ac84f853d884abd6f67d272e2e0b
SHA256

f8c50f0a2804cd25520d3ea9f28892a7405ab1e6e0319bfb1802202a7b96af52
SHA512

63822c814f3cc9588b8b5c5f28b9f1d9702fdfb3acc4107f7afa4d24064fad0cf70956cf11e4c7577df1d759781d864ec7e3f36113e2f1e51d97a1cacdfc39d7
SSDEEP

48:SalXWFPpT+dXVfzZh4yMGcKzMEkTaak4PAZivO2pB42pBdvMZL2R7tsRuqSxp:DWLkFfNnOKYloIQ2pm2pbYSIxE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2480	2132	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2480	2132	f8c50f0a2804cd25520d3ea9f28892a7405ab1e6e0319bfb1802202a7b96af52.exe	28
PID 2132 wrote to memory of 2480	2132	f8c50f0a2804cd25520d3ea9f28892a7405ab1e6e0319bfb1802202a7b96af52.exe	28
PID 2132 wrote to memory of 2480	2132	f8c50f0a2804cd25520d3ea9f28892a7405ab1e6e0319bfb1802202a7b96af52.exe	28
PID 2132 wrote to memory of 2480	2132	f8c50f0a2804cd25520d3ea9f28892a7405ab1e6e0319bfb1802202a7b96af52.exe	28

C:\Users\Admin\AppData\Local\Temp\f8c50f0a2804cd25520d3ea9f28892a7405ab1e6e0319bfb1802202a7b96af52.exe
"C:\Users\Admin\AppData\Local\Temp\f8c50f0a2804cd25520d3ea9f28892a7405ab1e6e0319bfb1802202a7b96af52.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 48
  2⤵
  - Program crash
  PID:2480