6ce52a4d0c82ea90902f5db34aaa423ae06b25bdec12466e8dd35a1e015f7f6b

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 05:11

Target

8a8bced4bf1a49a733ab1a94a5218c70N.exe
Size

472KB
MD5

8a8bced4bf1a49a733ab1a94a5218c70
SHA1

4aac23b05a092b5cafe2d643753bccf583bc82ae
SHA256

6ce52a4d0c82ea90902f5db34aaa423ae06b25bdec12466e8dd35a1e015f7f6b
SHA512

0a735371c82e14e73741f4ddd3a8142bffec2b20b108abc7cfe0fd281403d98f5863fbbb5305efcf81b4abbf49937cd18e9b4ea21b5700dc28f54d6f9c77f8a0
SSDEEP

3072:w8RinudiP52xx67lLdLiHDo8hMHdPga9wHTo5geiwb:1kgiPA6R1P8hM9uo5/ia

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2092	2088	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2092	2088	8a8bced4bf1a49a733ab1a94a5218c70N.exe	30
PID 2088 wrote to memory of 2092	2088	8a8bced4bf1a49a733ab1a94a5218c70N.exe	30
PID 2088 wrote to memory of 2092	2088	8a8bced4bf1a49a733ab1a94a5218c70N.exe	30
PID 2088 wrote to memory of 2092	2088	8a8bced4bf1a49a733ab1a94a5218c70N.exe	30

C:\Users\Admin\AppData\Local\Temp\8a8bced4bf1a49a733ab1a94a5218c70N.exe
"C:\Users\Admin\AppData\Local\Temp\8a8bced4bf1a49a733ab1a94a5218c70N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 36
  2⤵
  - Program crash
  PID:2092

memory/2088-1-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download