4f5c33b54a841bae7acb0e8216de5120a5b068ac60cfd158eca260d1f83cf067

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
18-05-2024 08:45

Target

1408_cn_V8.3.0.0/1408_cn_8.3.0.0/foo.exe
Size

304KB
MD5

59555007edc2e58f84e02403b6524131
SHA1

094aa76912fd62b3098617ed988c8b47529d1ebf
SHA256

33fb93fce6f3e077a1bd82913cdbd14b50de9e5435db1aa2ecf344bd031ff5e4
SHA512

522860b2cdfc1f5a2b38cfd5508d85557948bfc8762e302027b329bab49fc4b568b27d0cc5118bfd54ac60cdb3cd80545eb06e15ecaae93eeb55864e49cdf95f
SSDEEP

3072:k/jazHf6wLjEVcatttttttnz/yikU+XNYvfxc+6o45qIQopTqJpmIA2ca2nBEx82:k/jMSSIz9f+XNOJLv45xRPETGjU78Eb

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2996 2984 WerFault.exe foo.exe

pid	pid_target	process	target process
2996	2984	WerFault.exe	foo.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

foo.exe

description	pid	process	target process
PID 2984 wrote to memory of 2996	2984	foo.exe	WerFault.exe
PID 2984 wrote to memory of 2996	2984	foo.exe	WerFault.exe
PID 2984 wrote to memory of 2996	2984	foo.exe	WerFault.exe
PID 2984 wrote to memory of 2996	2984	foo.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1408_cn_V8.3.0.0\1408_cn_8.3.0.0\foo.exe
"C:\Users\Admin\AppData\Local\Temp\1408_cn_V8.3.0.0\1408_cn_8.3.0.0\foo.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 172
2⤵
- Program crash
PID:2996

memory/2984-0-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download