fe8b79e2efd9685857c859a5449501fdac4cb227b478beaa6c6f765d12589f0b

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 22:49

Target

fe8b79e2efd9685857c859a5449501fdac4cb227b478beaa6c6f765d12589f0b.exe
Size

497KB
MD5

7a7a09f3db15ab0f19a9a6f359fef8d7
SHA1

1096c1a07df97a68760fb1b4d2a932aed7e37aba
SHA256

fe8b79e2efd9685857c859a5449501fdac4cb227b478beaa6c6f765d12589f0b
SHA512

8f48e95c8e500f278198b5182b811247ed84401785b3718090930e7a99101d1380979a55c3784f60711baa7a3b1fb9829504df6c290627d0e7596e67d7d2e3fe
SSDEEP

12288:7COROIn2UaYK91zzI4G2YKudQjDV8bFr7GPPH6xKleovRAxO1A6:7COIA2MII4G2gQ29ePaxxca

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2564	1760	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2564	1760	fe8b79e2efd9685857c859a5449501fdac4cb227b478beaa6c6f765d12589f0b.exe	30
PID 1760 wrote to memory of 2564	1760	fe8b79e2efd9685857c859a5449501fdac4cb227b478beaa6c6f765d12589f0b.exe	30
PID 1760 wrote to memory of 2564	1760	fe8b79e2efd9685857c859a5449501fdac4cb227b478beaa6c6f765d12589f0b.exe	30
PID 1760 wrote to memory of 2564	1760	fe8b79e2efd9685857c859a5449501fdac4cb227b478beaa6c6f765d12589f0b.exe	30

C:\Users\Admin\AppData\Local\Temp\fe8b79e2efd9685857c859a5449501fdac4cb227b478beaa6c6f765d12589f0b.exe
"C:\Users\Admin\AppData\Local\Temp\fe8b79e2efd9685857c859a5449501fdac4cb227b478beaa6c6f765d12589f0b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 96
  2⤵
  - Program crash
  PID:2564

memory/1760-0-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download