e48850a92b4617d2fb70a56c4947829c098ab3b98a8892fa3f612570d8a8dfc4

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 18:50

Target

8fe3b3eac7f1436eeb666141b01450d5.exe
Size

76KB
MD5

8fe3b3eac7f1436eeb666141b01450d5
SHA1

dc60a676f91416615c5ec269effa1350c936696d
SHA256

e48850a92b4617d2fb70a56c4947829c098ab3b98a8892fa3f612570d8a8dfc4
SHA512

38f8f3af9e12d7ba5aebc513bcc2ebde785363677b881f67b505322c366e6f6ff6507752c3c9aac20b0217f57efb02c576b449dc1ead8e6d17f5af96a0997ba3
SSDEEP

1536:rkkkk/IWi2G4TK78Da4I1aVW9L8M9MeLTjuXoC0jEErxTWDTMqhGKYIZTET8x:rkkkk/IWFG448JeFBBLZC0jBkMqhGKZ5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2268	852	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 2268	852	8fe3b3eac7f1436eeb666141b01450d5.exe	28
PID 852 wrote to memory of 2268	852	8fe3b3eac7f1436eeb666141b01450d5.exe	28
PID 852 wrote to memory of 2268	852	8fe3b3eac7f1436eeb666141b01450d5.exe	28
PID 852 wrote to memory of 2268	852	8fe3b3eac7f1436eeb666141b01450d5.exe	28

C:\Users\Admin\AppData\Local\Temp\8fe3b3eac7f1436eeb666141b01450d5.exe
"C:\Users\Admin\AppData\Local\Temp\8fe3b3eac7f1436eeb666141b01450d5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 852 -s 36
  2⤵
  - Program crash
  PID:2268

memory/852-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download