b4e94d8db07afc81120d7903712260b66990101e15efe99f019073a8b8fa380c

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 01:53

Target

8decedeef8d00a672a6a9d565d48a182.exe
Size

333KB
MD5

8decedeef8d00a672a6a9d565d48a182
SHA1

e44df7a26c0f38ade5767eae007a0bfc5cca88cd
SHA256

b4e94d8db07afc81120d7903712260b66990101e15efe99f019073a8b8fa380c
SHA512

fd77ea92f05a69046c62b93dc9e61a6944fe75a0ac6391f740fa8abf83a5989036ddffc77387a139fdae3ead6fca22148fc6d58e9b872ab9afe170b744225d80
SSDEEP

6144:CBbyzoamoiNNhNcd7g2s6VZSzzr2NYV7eIlBCCAhteY/fm6vb480oAvPsnRmXXjO:qbyPmlbGkd6VZZNuB3AKy+6s85AvPimR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2404	3036	WerFault.exe	20

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2404	3036	8decedeef8d00a672a6a9d565d48a182.exe	28
PID 3036 wrote to memory of 2404	3036	8decedeef8d00a672a6a9d565d48a182.exe	28
PID 3036 wrote to memory of 2404	3036	8decedeef8d00a672a6a9d565d48a182.exe	28
PID 3036 wrote to memory of 2404	3036	8decedeef8d00a672a6a9d565d48a182.exe	28

C:\Users\Admin\AppData\Local\Temp\8decedeef8d00a672a6a9d565d48a182.exe
"C:\Users\Admin\AppData\Local\Temp\8decedeef8d00a672a6a9d565d48a182.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 88
  2⤵
  - Program crash
  PID:2404

memory/3036-0-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download