818fc42733deba9298158ef2ca98d4f9ef725cc94d7a22ade0a8f2e6c1b7b0c7

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 05:39

Target

8b89147fb5e79aa362b196b084dad8aa.exe
Size

45KB
MD5

8b89147fb5e79aa362b196b084dad8aa
SHA1

efa3d4d88e5234a4ab19d928e6d01823e8515c1f
SHA256

818fc42733deba9298158ef2ca98d4f9ef725cc94d7a22ade0a8f2e6c1b7b0c7
SHA512

14efe57e59c08e3aa8750430981f4557c2a13dad3a15bd7017532604ee176a5f86665de911e1e18ae476ce8128cdef18ed01c194b2e8cc687d3688a1e6b9340a
SSDEEP

768:MvronN1TOvxqGjZYn/Laa5zWtvQuC01QU75kma4OD/f4af0/1H5:Msn6JqGIeozWGuCGCmCIEK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2896	2856	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2896	2856	8b89147fb5e79aa362b196b084dad8aa.exe	23
PID 2856 wrote to memory of 2896	2856	8b89147fb5e79aa362b196b084dad8aa.exe	23
PID 2856 wrote to memory of 2896	2856	8b89147fb5e79aa362b196b084dad8aa.exe	23
PID 2856 wrote to memory of 2896	2856	8b89147fb5e79aa362b196b084dad8aa.exe	23

C:\Users\Admin\AppData\Local\Temp\8b89147fb5e79aa362b196b084dad8aa.exe
"C:\Users\Admin\AppData\Local\Temp\8b89147fb5e79aa362b196b084dad8aa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 140
  2⤵
  - Program crash
  PID:2896

memory/2856-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2856-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download