8f86d544be09948f1468c2a7c199c79bc5bffc519c24dde7ced09d7c61a00738

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 13:13

Target

998223715f5ea9e99775cb7a3bd595b4.exe
Size

128KB
MD5

998223715f5ea9e99775cb7a3bd595b4
SHA1

9c9e610d283acb663209540fb9da6e8ede4deaea
SHA256

8f86d544be09948f1468c2a7c199c79bc5bffc519c24dde7ced09d7c61a00738
SHA512

0404d13f2d359200d9ffe68a5c72374e7e7c27832d14f79514103aaa688568118f22cfbe639e7e507c673d0ae68c9bd9f7cdccfe7f997e771609ac84dbe7d980
SSDEEP

3072:5lxVHPZBuGTxM/NvwunzAq9em1Vw1kUCbk5sFiQNtOap:5lraG8+unzjVIDuFiQSK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2456	2168	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2456	2168	998223715f5ea9e99775cb7a3bd595b4.exe	28
PID 2168 wrote to memory of 2456	2168	998223715f5ea9e99775cb7a3bd595b4.exe	28
PID 2168 wrote to memory of 2456	2168	998223715f5ea9e99775cb7a3bd595b4.exe	28
PID 2168 wrote to memory of 2456	2168	998223715f5ea9e99775cb7a3bd595b4.exe	28

C:\Users\Admin\AppData\Local\Temp\998223715f5ea9e99775cb7a3bd595b4.exe
"C:\Users\Admin\AppData\Local\Temp\998223715f5ea9e99775cb7a3bd595b4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 36
  2⤵
  - Program crash
  PID:2456

memory/2168-0-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2168-1-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download