50d8f87a5340809e7c3f602a0ea322ffb00c62334a5bafffd43507adccf58573

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02-02-2024 10:56

Target

8955a82376ceafd2f6463e3963a8ecb9.exe
Size

23KB
MD5

8955a82376ceafd2f6463e3963a8ecb9
SHA1

4d1635515fad1f646cc9ee31eda74ae37fec1c1f
SHA256

50d8f87a5340809e7c3f602a0ea322ffb00c62334a5bafffd43507adccf58573
SHA512

b5b914412cc793f88d3dc50b88e603f4de36574a8e39472481357edb2a2ffc83de0742e2e873e0b413c72056aa3164e3ef04ffbe45688606b5dc2604c60c25ee
SSDEEP

384:ewSHrXfcZcJVr/+zY/981B3xXOoVLYjoGxq6wC+U23eQtUNrFJWM8EsP9qzxfFQY:elU2pc1BhXOkLYEGqUdqsxJ58EsVqdF5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2464	1632	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 2464	1632	8955a82376ceafd2f6463e3963a8ecb9.exe	28
PID 1632 wrote to memory of 2464	1632	8955a82376ceafd2f6463e3963a8ecb9.exe	28
PID 1632 wrote to memory of 2464	1632	8955a82376ceafd2f6463e3963a8ecb9.exe	28
PID 1632 wrote to memory of 2464	1632	8955a82376ceafd2f6463e3963a8ecb9.exe	28

C:\Users\Admin\AppData\Local\Temp\8955a82376ceafd2f6463e3963a8ecb9.exe
"C:\Users\Admin\AppData\Local\Temp\8955a82376ceafd2f6463e3963a8ecb9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 36
  2⤵
  - Program crash
  PID:2464