62cc184c4d4d6c205c1785c638a74ef296ba88de8eef87dfdb810dea424b524f

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 14:57

Target

8c9e88b7a203170283ea75fc5656fb61.exe
Size

692KB
MD5

8c9e88b7a203170283ea75fc5656fb61
SHA1

5831024065b45178e782c18001ffa349ab7e3c80
SHA256

62cc184c4d4d6c205c1785c638a74ef296ba88de8eef87dfdb810dea424b524f
SHA512

58c462737727164d0327fe98ef103f5bd5626110316bbdc4d8a89806ebf1493f012f814b24ec717eb90f07e959ed163cf3719af4710049f86285764bcd0836a4
SSDEEP

12288:Dd6S8/CwJcVuOPUaQXu+65jYMvzzVffqgePuEQidd4:Dd6S831OYE5XFfaPuExD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2692	3028	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2692	3028	8c9e88b7a203170283ea75fc5656fb61.exe	29
PID 3028 wrote to memory of 2692	3028	8c9e88b7a203170283ea75fc5656fb61.exe	29
PID 3028 wrote to memory of 2692	3028	8c9e88b7a203170283ea75fc5656fb61.exe	29
PID 3028 wrote to memory of 2692	3028	8c9e88b7a203170283ea75fc5656fb61.exe	29

C:\Users\Admin\AppData\Local\Temp\8c9e88b7a203170283ea75fc5656fb61.exe
"C:\Users\Admin\AppData\Local\Temp\8c9e88b7a203170283ea75fc5656fb61.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 152
  2⤵
  - Program crash
  PID:2692

memory/3028-0-0x000000004A460000-0x000000004A540000-memory.dmp

Filesize
896KB

Download
memory/3028-3-0x000000004A460000-0x000000004A540000-memory.dmp

Filesize
896KB

Download
memory/3028-1-0x000000004A460000-0x000000004A540000-memory.dmp

Filesize
896KB

Download
memory/3028-4-0x000000004A460000-0x000000004A540000-memory.dmp

Filesize
896KB

Download