c6156ef1da805d33d8096edb582f6d2fda1bcdb507470d54ac8fb9ef6d751a4f

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 08:25

Target

c6156ef1da805d33d8096edb582f6d2fda1bcdb507470d54ac8fb9ef6d751a4f.exe
Size

146KB
MD5

2f8d13e2f5775a9f63975d6cb83842a9
SHA1

bd2131bd1b291829e721899192723340f558899b
SHA256

c6156ef1da805d33d8096edb582f6d2fda1bcdb507470d54ac8fb9ef6d751a4f
SHA512

1e50f37a4c55f324ab4e200f1f8e8ad92077cade9f29b00aae87e03d6d9542f3d07f3d0ed198ff965999a0f143b20b1731bd198c9965e017084caae83a932a7e
SSDEEP

3072:mKtfDwsjPThTY4zDH2f05rZHqqUaE8x6gZudL851acfAgJ0mq2:ltfDwsjPThTFzL2SVqyv6gA6rfBJm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
836	1668	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 836	1668	c6156ef1da805d33d8096edb582f6d2fda1bcdb507470d54ac8fb9ef6d751a4f.exe	27
PID 1668 wrote to memory of 836	1668	c6156ef1da805d33d8096edb582f6d2fda1bcdb507470d54ac8fb9ef6d751a4f.exe	27
PID 1668 wrote to memory of 836	1668	c6156ef1da805d33d8096edb582f6d2fda1bcdb507470d54ac8fb9ef6d751a4f.exe	27
PID 1668 wrote to memory of 836	1668	c6156ef1da805d33d8096edb582f6d2fda1bcdb507470d54ac8fb9ef6d751a4f.exe	27

C:\Users\Admin\AppData\Local\Temp\c6156ef1da805d33d8096edb582f6d2fda1bcdb507470d54ac8fb9ef6d751a4f.exe
"C:\Users\Admin\AppData\Local\Temp\c6156ef1da805d33d8096edb582f6d2fda1bcdb507470d54ac8fb9ef6d751a4f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 136
  2⤵
  - Program crash
  PID:836