cff15d8949d0ff900998e82d4eee4cbebf29624d59ace34b875a434a10cb9b3f

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 00:49

Target

8af626d79700d8353ea0b466d54de715.exe
Size

374KB
MD5

8af626d79700d8353ea0b466d54de715
SHA1

a0f1bed698c3b1cdc128cee99b8fe8ff4157e6a0
SHA256

cff15d8949d0ff900998e82d4eee4cbebf29624d59ace34b875a434a10cb9b3f
SHA512

2b73da93b3c5e51c01734037338a3963183f1a4c5b7dd38f35f7e19186eec0c10df647b0237e884c0cebd83efca9dc44cf780de788ba4f07b313925d782a0068
SSDEEP

6144:eFSNNpecRUSEZ+1YSwajc4crP2CVqXDbertpQ9TgcgaBKWi7sJ/TaK299P7i:eiVKSELSvhNOtITgcgani7sJrV2Di

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1756	1540	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 1756	1540	8af626d79700d8353ea0b466d54de715.exe	28
PID 1540 wrote to memory of 1756	1540	8af626d79700d8353ea0b466d54de715.exe	28
PID 1540 wrote to memory of 1756	1540	8af626d79700d8353ea0b466d54de715.exe	28
PID 1540 wrote to memory of 1756	1540	8af626d79700d8353ea0b466d54de715.exe	28

C:\Users\Admin\AppData\Local\Temp\8af626d79700d8353ea0b466d54de715.exe
"C:\Users\Admin\AppData\Local\Temp\8af626d79700d8353ea0b466d54de715.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 272
  2⤵
  - Program crash
  PID:1756

memory/1540-0-0x0000000000400000-0x0000000000583000-memory.dmp

Filesize
1.5MB

Download
memory/1540-1-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1540-2-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1540-3-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1540-4-0x0000000000400000-0x0000000000583000-memory.dmp

Filesize
1.5MB

Download
memory/1540-5-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download