51ec33623ba34393a7d29cf4de3175712565274c4ee2887730dac7a7e4904631

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 18:47

Target

8fe28bf348a058391390b17ecf36ef8f.exe
Size

69KB
MD5

8fe28bf348a058391390b17ecf36ef8f
SHA1

0f3b1cf5b26e6e5cf62eebc9c31461c93d028fac
SHA256

51ec33623ba34393a7d29cf4de3175712565274c4ee2887730dac7a7e4904631
SHA512

8209b98ce92609629690e8770be152920d221dee017fb4a9f32a62b006343522a2d510489a26d4c321085331aad79105e256cd942fe02c24aba52e817cb47b38
SSDEEP

1536:+6l1rvkEZ23kI0eXxgGU0zfSx8ofz1Au4vlVXyCW+Lab/Mp2:t3rvRU3kDGU0zqx8ofWu4NVXyJ+Laop2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2876	2208	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2208	8fe28bf348a058391390b17ecf36ef8f.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2876	2208	8fe28bf348a058391390b17ecf36ef8f.exe	28
PID 2208 wrote to memory of 2876	2208	8fe28bf348a058391390b17ecf36ef8f.exe	28
PID 2208 wrote to memory of 2876	2208	8fe28bf348a058391390b17ecf36ef8f.exe	28
PID 2208 wrote to memory of 2876	2208	8fe28bf348a058391390b17ecf36ef8f.exe	28

C:\Users\Admin\AppData\Local\Temp\8fe28bf348a058391390b17ecf36ef8f.exe
"C:\Users\Admin\AppData\Local\Temp\8fe28bf348a058391390b17ecf36ef8f.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 84
  2⤵
  - Program crash
  PID:2876

memory/2208-0-0x0000000000400000-0x0000000000410258-memory.dmp

Filesize
64KB

Download