c8fe038aee8af4e4c539b1a28448b01f1a3c461e40c68950101fec536e92220e

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 09:38

Target

c8fe038aee8af4e4c539b1a28448b01f1a3c461e40c68950101fec536e92220e.exe
Size

484KB
MD5

c25f5b52ad5bd8e69a74fdfb4378cf1a
SHA1

8b06e0738bfc21b1b921941cc6603ed524c8e9e6
SHA256

c8fe038aee8af4e4c539b1a28448b01f1a3c461e40c68950101fec536e92220e
SHA512

e48aeb43611ccd30ddfc60ef1d1559d25522ff166e327d27fb4314599aec2ed656c4f0415f544fb593fea946bd2510805e4cb30ca8c9f0b1ecd97e9f9b7c861e
SSDEEP

12288:IvWWuLHuC9j9Z8EfC1PmUGP4cEzb3Rq8KJqD:CTuLHuEZ88kmUGgckb3R7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2040	2180	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2040	2180	c8fe038aee8af4e4c539b1a28448b01f1a3c461e40c68950101fec536e92220e.exe	28
PID 2180 wrote to memory of 2040	2180	c8fe038aee8af4e4c539b1a28448b01f1a3c461e40c68950101fec536e92220e.exe	28
PID 2180 wrote to memory of 2040	2180	c8fe038aee8af4e4c539b1a28448b01f1a3c461e40c68950101fec536e92220e.exe	28
PID 2180 wrote to memory of 2040	2180	c8fe038aee8af4e4c539b1a28448b01f1a3c461e40c68950101fec536e92220e.exe	28

C:\Users\Admin\AppData\Local\Temp\c8fe038aee8af4e4c539b1a28448b01f1a3c461e40c68950101fec536e92220e.exe
"C:\Users\Admin\AppData\Local\Temp\c8fe038aee8af4e4c539b1a28448b01f1a3c461e40c68950101fec536e92220e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 88
  2⤵
  - Program crash
  PID:2040

memory/2180-0-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2180-1-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download