8123c0e6e803c57b423f243fc57915377c7003cba37928a030ca142a00585c27

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:42

Target

8123c0e6e803c57b423f243fc57915377c7003cba37928a030ca142a00585c27.exe
Size

21KB
MD5

68d298d6d745c2a934afbf1013c5b63f
SHA1

f98935c7be72445e09ac4014531fcd1cd2c2b011
SHA256

8123c0e6e803c57b423f243fc57915377c7003cba37928a030ca142a00585c27
SHA512

daad4d64cfcae9cb82cb925bdc195092137a0fcc17629254b3976c2bf06232a012203f433aaf6b2882edc8a18bae71f895dbfe5fd5f8158d27b7a8edba7cadea
SSDEEP

192:uvSvPw2Rsr3w+mimw81l0DkRlSZhl8HL7gm5162s2SgXbqJDmULt:Y6wayA+1mwD5er7EgSgXuJDt

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2344 1612 WerFault.exe 8123c0e6e803c57b423f243fc57915377c7003cba37928a030ca142a00585c27.exe

pid	pid_target	process	target process
2344	1612	WerFault.exe	8123c0e6e803c57b423f243fc57915377c7003cba37928a030ca142a00585c27.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8123c0e6e803c57b423f243fc57915377c7003cba37928a030ca142a00585c27.exe

description	pid	process	target process
PID 1612 wrote to memory of 2344	1612	8123c0e6e803c57b423f243fc57915377c7003cba37928a030ca142a00585c27.exe	WerFault.exe
PID 1612 wrote to memory of 2344	1612	8123c0e6e803c57b423f243fc57915377c7003cba37928a030ca142a00585c27.exe	WerFault.exe
PID 1612 wrote to memory of 2344	1612	8123c0e6e803c57b423f243fc57915377c7003cba37928a030ca142a00585c27.exe	WerFault.exe
PID 1612 wrote to memory of 2344	1612	8123c0e6e803c57b423f243fc57915377c7003cba37928a030ca142a00585c27.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\8123c0e6e803c57b423f243fc57915377c7003cba37928a030ca142a00585c27.exe
"C:\Users\Admin\AppData\Local\Temp\8123c0e6e803c57b423f243fc57915377c7003cba37928a030ca142a00585c27.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 36
2⤵
- Program crash
PID:2344

memory/1612-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download