942dc6ce82f110ac7205ad6f9bed61263cee1f9f88072348f4634f994a3e7d1a

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 07:45

Target

8e998195ed0d5349e7b1aac357ef094f.exe
Size

59KB
MD5

8e998195ed0d5349e7b1aac357ef094f
SHA1

1af1d4fc6bb5ff1951043a53d73f2503c4a6bd52
SHA256

942dc6ce82f110ac7205ad6f9bed61263cee1f9f88072348f4634f994a3e7d1a
SHA512

59c7b3d83a7520c54d2a05cd1d57137b7b36fd757fbdce06abe3eb2712811704d48d07aa81379bc8970d57239890b912cbe79c4fb69e7110982d934d9a198708
SSDEEP

1536:mwOINxo83O8dE9xO7ZzEzNR5UjnXlrsnlvD/ddS8Wk9qRuha:mx2e8dqsEBR49chDbSLxRw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2924	2548	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2924	2548	8e998195ed0d5349e7b1aac357ef094f.exe	28
PID 2548 wrote to memory of 2924	2548	8e998195ed0d5349e7b1aac357ef094f.exe	28
PID 2548 wrote to memory of 2924	2548	8e998195ed0d5349e7b1aac357ef094f.exe	28
PID 2548 wrote to memory of 2924	2548	8e998195ed0d5349e7b1aac357ef094f.exe	28

C:\Users\Admin\AppData\Local\Temp\8e998195ed0d5349e7b1aac357ef094f.exe
"C:\Users\Admin\AppData\Local\Temp\8e998195ed0d5349e7b1aac357ef094f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 44
  2⤵
  - Program crash
  PID:2924

memory/2548-0-0x00000000005E0000-0x00000000006BC000-memory.dmp

Filesize
880KB

Download
memory/2548-1-0x0000000000410000-0x00000000004EA000-memory.dmp

Filesize
872KB

Download