9f38ec0ae60879931f99054695285b54f0d2454990249d4672acfb568905bf91

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 12:30

Target

8246f422d28415bbb58d8fa3e2891817.exe
Size

582KB
MD5

8246f422d28415bbb58d8fa3e2891817
SHA1

0a7d9fa2340210aa6090be64a26385b78d13c6ef
SHA256

9f38ec0ae60879931f99054695285b54f0d2454990249d4672acfb568905bf91
SHA512

4f44bcb125b14b86f6b772d23a99338be0394d04a32839a0bc7bd0344cab785bde2529bcd01a62032f74614125718666935fa4be1d276e60ce9969200ff317f0
SSDEEP

12288:es7vnRmS7+nqB3visIP1z20lBoLhaByXOh7OWMsIaHqZm+Ps6:XvQSUq0sIPB20UVasX07isFHqZm+Ps6

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2180 1284 WerFault.exe 8246f422d28415bbb58d8fa3e2891817.exe

pid	pid_target	process	target process
2180	1284	WerFault.exe	8246f422d28415bbb58d8fa3e2891817.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8246f422d28415bbb58d8fa3e2891817.exe

description	pid	process	target process
PID 1284 wrote to memory of 2180	1284	8246f422d28415bbb58d8fa3e2891817.exe	WerFault.exe
PID 1284 wrote to memory of 2180	1284	8246f422d28415bbb58d8fa3e2891817.exe	WerFault.exe
PID 1284 wrote to memory of 2180	1284	8246f422d28415bbb58d8fa3e2891817.exe	WerFault.exe
PID 1284 wrote to memory of 2180	1284	8246f422d28415bbb58d8fa3e2891817.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\8246f422d28415bbb58d8fa3e2891817.exe
"C:\Users\Admin\AppData\Local\Temp\8246f422d28415bbb58d8fa3e2891817.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1284 -s 52
2⤵
- Program crash
PID:2180

memory/1284-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1284-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download