e22a5cadeacc1a9d95354d85bdc17f6ab2dc5d23efe7df6d3d4683fb7b881a52

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 18:26

Target

8ea62cf58512d2544c0f66fbf28e12c7a8344d4a08e8256c968a35de58ccc513.exe
Size

498KB
MD5

4bcbf97b45320fd1995037b5c2fda8ba
SHA1

e5d82af83ef9875c435942d34f79d92a62a65672
SHA256

8ea62cf58512d2544c0f66fbf28e12c7a8344d4a08e8256c968a35de58ccc513
SHA512

c4ae95de3e086442b19c01b18cb8e9ee12aecff5f2a2f3b96c55f1d95ebe871967f7445e364078209d3a0947805aea492459d2586bf9ab453e11d0cc90f76f26
SSDEEP

12288:p9I+5gSN27L4AhsAXjl7p8d0oDrVR583JNPamoCe:I+5/NQx2YRpfoNiJNSPR

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1788 628 WerFault.exe 8ea62cf58512d2544c0f66fbf28e12c7a8344d4a08e8256c968a35de58ccc513.exe

pid	pid_target	process	target process
1788	628	WerFault.exe	8ea62cf58512d2544c0f66fbf28e12c7a8344d4a08e8256c968a35de58ccc513.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8ea62cf58512d2544c0f66fbf28e12c7a8344d4a08e8256c968a35de58ccc513.exe

description	pid	process	target process
PID 628 wrote to memory of 1788	628	8ea62cf58512d2544c0f66fbf28e12c7a8344d4a08e8256c968a35de58ccc513.exe	WerFault.exe
PID 628 wrote to memory of 1788	628	8ea62cf58512d2544c0f66fbf28e12c7a8344d4a08e8256c968a35de58ccc513.exe	WerFault.exe
PID 628 wrote to memory of 1788	628	8ea62cf58512d2544c0f66fbf28e12c7a8344d4a08e8256c968a35de58ccc513.exe	WerFault.exe
PID 628 wrote to memory of 1788	628	8ea62cf58512d2544c0f66fbf28e12c7a8344d4a08e8256c968a35de58ccc513.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\8ea62cf58512d2544c0f66fbf28e12c7a8344d4a08e8256c968a35de58ccc513.exe
"C:\Users\Admin\AppData\Local\Temp\8ea62cf58512d2544c0f66fbf28e12c7a8344d4a08e8256c968a35de58ccc513.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 48
2⤵
- Program crash
PID:1788

memory/628-0-0x0000000000A4C000-0x0000000000A4D000-memory.dmp

Filesize
4KB

Download