4f5c33b54a841bae7acb0e8216de5120a5b068ac60cfd158eca260d1f83cf067

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
18-05-2024 08:45

Target

1408_cn_V8.3.0.0/1408_cn_8.3.0.0/Setup.exe
Size

6.1MB
MD5

ad5def7b4d6685fbd3ca1b54804ff2a0
SHA1

ac303840cf6eaef3670400330e81c40cd21b55e2
SHA256

1e113923ae4b006ef4a8102f110710cca92ff10c1940bd218a0eacbd9bc97e07
SHA512

c3ca2ac7d35698c39db059c957da8eb3f6a18a1c6f5c5612d0ac506600c3abcecc6c1b48d6dcb0d149758d6d7d57589056e5526759d95996e11f4942679eadeb
SSDEEP

49152:OmujQnm3XvHntgeMND47DnGKMMMMMMMMMRmJwD:OmujQnHKMMMMMMMMMRmU

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2968 844 WerFault.exe Setup.exe

pid	pid_target	process	target process
2968	844	WerFault.exe	Setup.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

Setup.exe

description	pid	process	target process
PID 844 wrote to memory of 2968	844	Setup.exe	WerFault.exe
PID 844 wrote to memory of 2968	844	Setup.exe	WerFault.exe
PID 844 wrote to memory of 2968	844	Setup.exe	WerFault.exe
PID 844 wrote to memory of 2968	844	Setup.exe	WerFault.exe
PID 844 wrote to memory of 2968	844	Setup.exe	WerFault.exe
PID 844 wrote to memory of 2968	844	Setup.exe	WerFault.exe
PID 844 wrote to memory of 2968	844	Setup.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1408_cn_V8.3.0.0\1408_cn_8.3.0.0\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\1408_cn_V8.3.0.0\1408_cn_8.3.0.0\Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 844 -s 324
2⤵
- Program crash
PID:2968

memory/844-0-0x0000000000400000-0x0000000000A2A000-memory.dmp

Filesize
6.2MB

Download
memory/844-1-0x0000000000FB0000-0x00000000015DA000-memory.dmp

Filesize
6.2MB

Download
memory/844-2-0x0000000000FB0000-0x00000000015DA000-memory.dmp

Filesize
6.2MB

Download