8b5fded525d763a2c70de34287061097ce2dd8556ede4b5f23b3b284cbaeb900

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 00:18

Target

8b5fded525d763a2c70de34287061097ce2dd8556ede4b5f23b3b284cbaeb900.exe
Size

212KB
MD5

1544d5810d3647ab477d1d198e1e7e6b
SHA1

aea94307f59a972abd630ad9786b1a3951161c0f
SHA256

8b5fded525d763a2c70de34287061097ce2dd8556ede4b5f23b3b284cbaeb900
SHA512

26b59cbec5c65877d410f38935bce9b0ff1bd42b02589fbabce2cff1ad9c6af15fa743e72c584002570cbadb30ade5f949157050e444ef57ab6bb97942b5f8af
SSDEEP

6144:BESeWo3N9TA1vTPGecsj+OQtugp89r9u98:jPGoBQtuA8Zw8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2808	2092	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2808	2092	8b5fded525d763a2c70de34287061097ce2dd8556ede4b5f23b3b284cbaeb900.exe	28
PID 2092 wrote to memory of 2808	2092	8b5fded525d763a2c70de34287061097ce2dd8556ede4b5f23b3b284cbaeb900.exe	28
PID 2092 wrote to memory of 2808	2092	8b5fded525d763a2c70de34287061097ce2dd8556ede4b5f23b3b284cbaeb900.exe	28
PID 2092 wrote to memory of 2808	2092	8b5fded525d763a2c70de34287061097ce2dd8556ede4b5f23b3b284cbaeb900.exe	28

C:\Users\Admin\AppData\Local\Temp\8b5fded525d763a2c70de34287061097ce2dd8556ede4b5f23b3b284cbaeb900.exe
"C:\Users\Admin\AppData\Local\Temp\8b5fded525d763a2c70de34287061097ce2dd8556ede4b5f23b3b284cbaeb900.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 44
  2⤵
  - Program crash
  PID:2808