6f17f5c544c0cb06707cffe791ac92781dede26d72141c8324ed3aedaf7c3319

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 10:58

Target

8efa98fd7be9477c5537f13663793c39.exe
Size

582KB
MD5

8efa98fd7be9477c5537f13663793c39
SHA1

5fc551bde3fdd1cfbabe7a54ddeb71c9fb995ecf
SHA256

6f17f5c544c0cb06707cffe791ac92781dede26d72141c8324ed3aedaf7c3319
SHA512

d6af6d4275ee193bac057bfa6a0d6c0384a0caeb4b365d0451294ee78d3ee9123c5b1a4c243deae4180562ed2e89c99a7d9601c69d86eba9c9efeee29c2a3fbb
SSDEEP

6144:jpOzvjuOD/Rir/nDdxvoEB02oWYsLxlH1CMX/D751LmZXds54p2G+1lDogogEfu5:rrnDnvPBAuxlVtD751epHur17r

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1644	2516	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 1644	2516	8efa98fd7be9477c5537f13663793c39.exe	28
PID 2516 wrote to memory of 1644	2516	8efa98fd7be9477c5537f13663793c39.exe	28
PID 2516 wrote to memory of 1644	2516	8efa98fd7be9477c5537f13663793c39.exe	28
PID 2516 wrote to memory of 1644	2516	8efa98fd7be9477c5537f13663793c39.exe	28

C:\Users\Admin\AppData\Local\Temp\8efa98fd7be9477c5537f13663793c39.exe
"C:\Users\Admin\AppData\Local\Temp\8efa98fd7be9477c5537f13663793c39.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 196
  2⤵
  - Program crash
  PID:1644

memory/2516-1-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2516-2-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download