a7022409c09a4da44d79c29f65959a60609a2f06384eb98e90eb9a36e2a88851

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04-02-2024 03:43

Target

8e20fa4f86e77bf3a99d7659a6ba706c.exe
Size

45KB
MD5

8e20fa4f86e77bf3a99d7659a6ba706c
SHA1

a8e16e84265a1fc82fe2d13095c2c567274f2e5c
SHA256

a7022409c09a4da44d79c29f65959a60609a2f06384eb98e90eb9a36e2a88851
SHA512

53f9b03bc20b24b91a37b71a4cf708b4eb75b2e948ca9d79d119db5573bdb0138cb956cd358517e64f883bef1b9ef4cfaec88de69869c25c190f3458a8f0e5d3
SSDEEP

768:YZWD+kjRXY1y1ETxO6Bn2XrEtAzkPRGUulN7c5UUgs13uR3+fGxxNj:ikqxjnntAYPR87m15uagxN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2472	3052	WerFault.exe	12

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2472	3052	8e20fa4f86e77bf3a99d7659a6ba706c.exe	29
PID 3052 wrote to memory of 2472	3052	8e20fa4f86e77bf3a99d7659a6ba706c.exe	29
PID 3052 wrote to memory of 2472	3052	8e20fa4f86e77bf3a99d7659a6ba706c.exe	29
PID 3052 wrote to memory of 2472	3052	8e20fa4f86e77bf3a99d7659a6ba706c.exe	29

C:\Users\Admin\AppData\Local\Temp\8e20fa4f86e77bf3a99d7659a6ba706c.exe
"C:\Users\Admin\AppData\Local\Temp\8e20fa4f86e77bf3a99d7659a6ba706c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 88
  2⤵
  - Program crash
  PID:2472

memory/3052-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/3052-1-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download