2b0e8a396c807298606183370b6d715c40bee3eb04bff041906a7531797f830e

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 14:14

Target

c82578d2459f1eec38956549b0b102f0N.exe
Size

896KB
MD5

c82578d2459f1eec38956549b0b102f0
SHA1

4c86a9781a33d278a1135907c78af6ebdf412a3f
SHA256

2b0e8a396c807298606183370b6d715c40bee3eb04bff041906a7531797f830e
SHA512

68b6a7dee38ff3491d649807efb9912215a175f18ffddb35b86c37aa1fc9c8ac7f5d85d2e80ae4e9c62b713029cf083941d70730be48f159636eae714dd860bd
SSDEEP

12288:+lEJRXFnKByvNv54B9f01ZmqLonfBHLqF1Nw5ILonfByvNv5HV:oUfvr4B9f01ZmoENOVvr1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2752	2708	WerFault.exe	30

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2752	2708	c82578d2459f1eec38956549b0b102f0N.exe	31
PID 2708 wrote to memory of 2752	2708	c82578d2459f1eec38956549b0b102f0N.exe	31
PID 2708 wrote to memory of 2752	2708	c82578d2459f1eec38956549b0b102f0N.exe	31
PID 2708 wrote to memory of 2752	2708	c82578d2459f1eec38956549b0b102f0N.exe	31

C:\Users\Admin\AppData\Local\Temp\c82578d2459f1eec38956549b0b102f0N.exe
"C:\Users\Admin\AppData\Local\Temp\c82578d2459f1eec38956549b0b102f0N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 140
  2⤵
  - Program crash
  PID:2752

memory/2708-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2708-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download