3e7ea1d4ec963705884d57a9bbac16c0b00835b886cd054053c90fc7049ef381

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 14:58

Target

c8e83c32cdf765a1637dfc1da4fc051a.exe
Size

83KB
MD5

c8e83c32cdf765a1637dfc1da4fc051a
SHA1

f38cfd96c4d039f0830d81fa6925b2515f28b091
SHA256

3e7ea1d4ec963705884d57a9bbac16c0b00835b886cd054053c90fc7049ef381
SHA512

fde2930bb5e01cec80a20b1511489ef7ae23fa930189f0a71d6d856c30172d9b70b3b951e5c3f015f84f248b2fdb8542380acd4670ffac2267cc993080808cff
SSDEEP

1536:pSIynvPoMHqMPz++16138QWCS1yoMTDxcHNIXp2ld6mly9kHQ:p0n3o5M7z1BQWCS1pqDxcHNIXpkdjlyx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2756	2952	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 2756	2952	c8e83c32cdf765a1637dfc1da4fc051a.exe	28
PID 2952 wrote to memory of 2756	2952	c8e83c32cdf765a1637dfc1da4fc051a.exe	28
PID 2952 wrote to memory of 2756	2952	c8e83c32cdf765a1637dfc1da4fc051a.exe	28
PID 2952 wrote to memory of 2756	2952	c8e83c32cdf765a1637dfc1da4fc051a.exe	28

C:\Users\Admin\AppData\Local\Temp\c8e83c32cdf765a1637dfc1da4fc051a.exe
"C:\Users\Admin\AppData\Local\Temp\c8e83c32cdf765a1637dfc1da4fc051a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 124
  2⤵
  - Program crash
  PID:2756

memory/2952-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download