8f7cb54a9280a088b4965d80fcd555acaa84c56823c35d647931e283995fb1c7

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 13:48

Target

8c7b3c0f56bd01577c7cfcc8f14ec049.exe
Size

92KB
MD5

8c7b3c0f56bd01577c7cfcc8f14ec049
SHA1

e078403b8a3f7407a580264c4704803561fe2bcc
SHA256

8f7cb54a9280a088b4965d80fcd555acaa84c56823c35d647931e283995fb1c7
SHA512

905f5b25b1e21f566c3decad65c3ba7702f44e42b4c46e6eb4b5fd0d52727bd9ea3212318239778c65261fc72fc2e24cc3ed9535dff2504e9aefa059d3d2e9e8
SSDEEP

1536:KoGe80O4rl1hefJ2tjBAs3hNuo2twm6J8iAH9VQRXCsOYY:KTeDnrlDi2tjBAs3tL78HjQRy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1616	1704	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1616	1704	8c7b3c0f56bd01577c7cfcc8f14ec049.exe	28
PID 1704 wrote to memory of 1616	1704	8c7b3c0f56bd01577c7cfcc8f14ec049.exe	28
PID 1704 wrote to memory of 1616	1704	8c7b3c0f56bd01577c7cfcc8f14ec049.exe	28
PID 1704 wrote to memory of 1616	1704	8c7b3c0f56bd01577c7cfcc8f14ec049.exe	28

C:\Users\Admin\AppData\Local\Temp\8c7b3c0f56bd01577c7cfcc8f14ec049.exe
"C:\Users\Admin\AppData\Local\Temp\8c7b3c0f56bd01577c7cfcc8f14ec049.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 36
  2⤵
  - Program crash
  PID:1616

memory/1704-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1704-1-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download