6cb14cd1b000f5a84325883be1d12c306971114143fe879b20e94e350a155873

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 10:55

Target

6cb14cd1b000f5a84325883be1d12c306971114143fe879b20e94e350a155873.exe
Size

61KB
MD5

92097e3e6fd8a8e32a7980f858d8d907
SHA1

5faa3c7d125b69cbf2923009515c3d4aec9fa81e
SHA256

6cb14cd1b000f5a84325883be1d12c306971114143fe879b20e94e350a155873
SHA512

417684476d854cb802bf57ff5a53a536ed066e4b2d9bdd575d68d54e0962da2fc8bd04724a54c4bba4d92394eb3f143aa536b3a97c75be580fe9b6c84be7d23e
SSDEEP

1536:49l+WVFCjQioI9npFZufUMYOAPEQrCRwP:4GWVcvZPMYOA/CRwP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1112	1768	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1112	1768	6cb14cd1b000f5a84325883be1d12c306971114143fe879b20e94e350a155873.exe	27
PID 1768 wrote to memory of 1112	1768	6cb14cd1b000f5a84325883be1d12c306971114143fe879b20e94e350a155873.exe	27
PID 1768 wrote to memory of 1112	1768	6cb14cd1b000f5a84325883be1d12c306971114143fe879b20e94e350a155873.exe	27
PID 1768 wrote to memory of 1112	1768	6cb14cd1b000f5a84325883be1d12c306971114143fe879b20e94e350a155873.exe	27

C:\Users\Admin\AppData\Local\Temp\6cb14cd1b000f5a84325883be1d12c306971114143fe879b20e94e350a155873.exe
"C:\Users\Admin\AppData\Local\Temp\6cb14cd1b000f5a84325883be1d12c306971114143fe879b20e94e350a155873.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 36
  2⤵
  - Program crash
  PID:1112

memory/1768-55-0x0000000000400000-0x0000000000425489-memory.dmp

Filesize
149KB

Download