8ada5a91bd369a1833994f1c8064fe1b47033be7ff443344ac47206fceba216c

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 20:33

Target

8ada5a91bd369a1833994f1c8064fe1b47033be7ff443344ac47206fceba216c.exe
Size

2.8MB
MD5

570e60c91da2782ef3e301fe0fe13a49
SHA1

b4dd2de6e9d0b87afa20ad9bc38f42a2a25cd40b
SHA256

8ada5a91bd369a1833994f1c8064fe1b47033be7ff443344ac47206fceba216c
SHA512

56bb023a6b7b4ba9590cc62c9916af9e79c53e529539e822b7cdd630b8f41c22cf3b2aa7c59500cb7699d77c4ef35a64cb4a04c073cc59fd5b2850ee77e7cb35
SSDEEP

49152:CUs4vWbQe5QZuTtS0rQMYOQ+q8CE1jSn6ri+jStG9KFeMS:Hs4O5WsM0r1QnAOdG0Fen

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2928	2876	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2928	2876	8ada5a91bd369a1833994f1c8064fe1b47033be7ff443344ac47206fceba216c.exe	28
PID 2876 wrote to memory of 2928	2876	8ada5a91bd369a1833994f1c8064fe1b47033be7ff443344ac47206fceba216c.exe	28
PID 2876 wrote to memory of 2928	2876	8ada5a91bd369a1833994f1c8064fe1b47033be7ff443344ac47206fceba216c.exe	28
PID 2876 wrote to memory of 2928	2876	8ada5a91bd369a1833994f1c8064fe1b47033be7ff443344ac47206fceba216c.exe	28

C:\Users\Admin\AppData\Local\Temp\8ada5a91bd369a1833994f1c8064fe1b47033be7ff443344ac47206fceba216c.exe
"C:\Users\Admin\AppData\Local\Temp\8ada5a91bd369a1833994f1c8064fe1b47033be7ff443344ac47206fceba216c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 136
  2⤵
  - Program crash
  PID:2928

memory/2876-0-0x0000000000390000-0x00000000003F9000-memory.dmp

Filesize
420KB

Download