69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 11:04

Target

69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
Size

544KB
MD5

4c743c9faa0d584983aa4e096fe7a4de
SHA1

0a418ea55271587d8bab6db2060bf6c4122ddd5b
SHA256

69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79
SHA512

76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47
SSDEEP

12288:m6bvdl0zCB8EDItMTzwg7lMQsvNuqZBRbZEYTwdD7IjLgdwdH2qGDAjs:/vdezCByqTtlMQsFuqzRbzI7IpH2N5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
668	1932	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 668	1932	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe	28
PID 1932 wrote to memory of 668	1932	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe	28
PID 1932 wrote to memory of 668	1932	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe	28
PID 1932 wrote to memory of 668	1932	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe	28

C:\Users\Admin\AppData\Local\Temp\69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
"C:\Users\Admin\AppData\Local\Temp\69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 120
  2⤵
  - Program crash
  PID:668

memory/1932-54-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download