ca9699a23d2a9c4378f8b6ce9af811886c2077faf99e3a261db4c3c3883a661b

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 04:13

Target

8e30437f06832f8d820af5e0111ea072.exe
Size

16KB
MD5

8e30437f06832f8d820af5e0111ea072
SHA1

8f9373d2ed7c77c70e42de95fc80cd12eb8f80cc
SHA256

ca9699a23d2a9c4378f8b6ce9af811886c2077faf99e3a261db4c3c3883a661b
SHA512

e894350505feeeff18ee1eb32ea667ecaf7844f2b37315875177299036b7496707e564154820fa09a9515e24d09196de405224cf55e758f4086a75dbe36b4b18
SSDEEP

192:BYUE6IOlwHuFxJeB3Cb1V85+zIMVSH8SMXSM+rhxs5Yr7vmnSXjtfRvww4SA3Wpx:BYUE6FyHuNeZSXOW1SM+rhrHBzjw9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
320	1044	WerFault.exe	11

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 320	1044	8e30437f06832f8d820af5e0111ea072.exe	28
PID 1044 wrote to memory of 320	1044	8e30437f06832f8d820af5e0111ea072.exe	28
PID 1044 wrote to memory of 320	1044	8e30437f06832f8d820af5e0111ea072.exe	28
PID 1044 wrote to memory of 320	1044	8e30437f06832f8d820af5e0111ea072.exe	28

C:\Users\Admin\AppData\Local\Temp\8e30437f06832f8d820af5e0111ea072.exe
"C:\Users\Admin\AppData\Local\Temp\8e30437f06832f8d820af5e0111ea072.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 140
  2⤵
  - Program crash
  PID:320

memory/1044-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1044-1-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download