008c66dc46eef4efc45fb8c2487cdfb5e0489dcb52f57dc54f4ce9bbb28e75c8

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 01:23

Target

008c66dc46eef4efc45fb8c2487cdfb5e0489dcb52f57dc54f4ce9bbb28e75c8.exe
Size

1.7MB
MD5

f8a2e4f3c4f94f9712a698cf98a1a07b
SHA1

5602916d694c747cf133197d4ca4ee589efc2701
SHA256

008c66dc46eef4efc45fb8c2487cdfb5e0489dcb52f57dc54f4ce9bbb28e75c8
SHA512

b4b11a5a503638059b5b8647d3247f3b7b51c78d009bbc3a58b58768ea357b073d41fda3cc04a0d438adbf32054af1921df63fed551cd019d79c74b40d748122
SSDEEP

12288:ZZBuGjvcpsks9ncJwYkw0LOLHjHd3KfWwNU17o126+X6R243qPI4VDfVu39I3kcV:30sn9+gS6uHk1U43yIkNcI01m

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2328 2072 WerFault.exe 008c66dc46eef4efc45fb8c2487cdfb5e0489dcb52f57dc54f4ce9bbb28e75c8.exe

pid	pid_target	process	target process
2328	2072	WerFault.exe	008c66dc46eef4efc45fb8c2487cdfb5e0489dcb52f57dc54f4ce9bbb28e75c8.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

008c66dc46eef4efc45fb8c2487cdfb5e0489dcb52f57dc54f4ce9bbb28e75c8.exe

description	pid	process	target process
PID 2072 wrote to memory of 2328	2072	008c66dc46eef4efc45fb8c2487cdfb5e0489dcb52f57dc54f4ce9bbb28e75c8.exe	WerFault.exe
PID 2072 wrote to memory of 2328	2072	008c66dc46eef4efc45fb8c2487cdfb5e0489dcb52f57dc54f4ce9bbb28e75c8.exe	WerFault.exe
PID 2072 wrote to memory of 2328	2072	008c66dc46eef4efc45fb8c2487cdfb5e0489dcb52f57dc54f4ce9bbb28e75c8.exe	WerFault.exe
PID 2072 wrote to memory of 2328	2072	008c66dc46eef4efc45fb8c2487cdfb5e0489dcb52f57dc54f4ce9bbb28e75c8.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\008c66dc46eef4efc45fb8c2487cdfb5e0489dcb52f57dc54f4ce9bbb28e75c8.exe
"C:\Users\Admin\AppData\Local\Temp\008c66dc46eef4efc45fb8c2487cdfb5e0489dcb52f57dc54f4ce9bbb28e75c8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 548
2⤵
- Program crash
PID:2328

memory/2072-0-0x00000000748EE000-0x00000000748EF000-memory.dmp

Filesize
4KB

Download
memory/2072-1-0x0000000000A60000-0x0000000000C22000-memory.dmp

Filesize
1.8MB

Download
memory/2072-2-0x00000000748EE000-0x00000000748EF000-memory.dmp

Filesize
4KB

Download