f9c46645993d21a9537c3b49cf85c57e42fa39e61bfbec1d285234c108f98ba6

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 06:58

Target

8e82535ed308f74edf369a52a08b2d33.exe
Size

1.8MB
MD5

8e82535ed308f74edf369a52a08b2d33
SHA1

376c86afcb543151d00d9f45a81637edb29e3949
SHA256

f9c46645993d21a9537c3b49cf85c57e42fa39e61bfbec1d285234c108f98ba6
SHA512

7f5ecbf56a00e515b9a8d9458a5ee77bb8b3e37634d2928a881221c12e13cf541964de92b7cc1dc3881a08b8871b5d7c9d222bb3ea1fe47c4e7078e5954ebfad
SSDEEP

24576:YlXKBIxZMHEDpRRGr8goTGEMH2jq9zZoeUrkZLGApoZvzcbrxJm/whj:tIxmwGr8TMH2jqLoe5oApurcbtJm/whj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2392	1768	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 2392	1768	8e82535ed308f74edf369a52a08b2d33.exe	28
PID 1768 wrote to memory of 2392	1768	8e82535ed308f74edf369a52a08b2d33.exe	28
PID 1768 wrote to memory of 2392	1768	8e82535ed308f74edf369a52a08b2d33.exe	28
PID 1768 wrote to memory of 2392	1768	8e82535ed308f74edf369a52a08b2d33.exe	28

C:\Users\Admin\AppData\Local\Temp\8e82535ed308f74edf369a52a08b2d33.exe
"C:\Users\Admin\AppData\Local\Temp\8e82535ed308f74edf369a52a08b2d33.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 36
  2⤵
  - Program crash
  PID:2392