e8cfa3a57dc6220c2f5135cb71975937634d5a8be6179790f7ffd9a7498606fb

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 23:45

Target

VirusShare-01747edce9fe983507c5ee05cd990668.exe
Size

68KB
MD5

01747edce9fe983507c5ee05cd990668
SHA1

babcacfa6c2ad21440c319f13560fd094eb1d6c5
SHA256

e8cfa3a57dc6220c2f5135cb71975937634d5a8be6179790f7ffd9a7498606fb
SHA512

aaa2c6fa681086b3227f3ea32685c7008c9292c0ac18515bdf0917140e931de806ffc86271b38f1ada8c591e5033e5d5a3ac096547f83cbc8c9e0c1be00f6d19
SSDEEP

1536:L2eZUw3IPe+glREQki0JTWmMhHGzGpqOoyf6zPbtPY+:LIQLNCQkiEGoKkPbC+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2712	2984	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2712	2984	VirusShare-01747edce9fe983507c5ee05cd990668.exe	28
PID 2984 wrote to memory of 2712	2984	VirusShare-01747edce9fe983507c5ee05cd990668.exe	28
PID 2984 wrote to memory of 2712	2984	VirusShare-01747edce9fe983507c5ee05cd990668.exe	28
PID 2984 wrote to memory of 2712	2984	VirusShare-01747edce9fe983507c5ee05cd990668.exe	28

C:\Users\Admin\AppData\Local\Temp\VirusShare-01747edce9fe983507c5ee05cd990668.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare-01747edce9fe983507c5ee05cd990668.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 52
  2⤵
  - Program crash
  PID:2712

memory/2984-0-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2984-1-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download