4f2c8cc950a8281e1fc2248b2917a3b17be393f74338fc15da85abda4203c532

Analysis

max time kernel
117s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-03-2024 15:18

Target

c8f303eb479acc49a376bfb7b9033223.exe
Size

24KB
MD5

c8f303eb479acc49a376bfb7b9033223
SHA1

59970d0769858f19b1fb86ed4c371168faf11c43
SHA256

4f2c8cc950a8281e1fc2248b2917a3b17be393f74338fc15da85abda4203c532
SHA512

58c9b5554a973b04394e9fa51428b197d27d76e6358209179da204aa5be4522a4e81f225f7687053c3474eccd034a7afc8c105fcb2f8158c6c785c1d0b0d744f
SSDEEP

384:fuFHheMqIgFkb7v/NjfgP0eQ1IF7/HYioPZhxpXAOgL7ybYrBBAh3A:yHTBgFkb7dT60eUDi07wOk7ykB6h3A

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1892	2020	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1892	2020	c8f303eb479acc49a376bfb7b9033223.exe	28
PID 2020 wrote to memory of 1892	2020	c8f303eb479acc49a376bfb7b9033223.exe	28
PID 2020 wrote to memory of 1892	2020	c8f303eb479acc49a376bfb7b9033223.exe	28
PID 2020 wrote to memory of 1892	2020	c8f303eb479acc49a376bfb7b9033223.exe	28

C:\Users\Admin\AppData\Local\Temp\c8f303eb479acc49a376bfb7b9033223.exe
"C:\Users\Admin\AppData\Local\Temp\c8f303eb479acc49a376bfb7b9033223.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 88
  2⤵
  - Program crash
  PID:1892

memory/2020-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download