6c45b638473370ff683c53d0258f2c234304bbf8a458d8cfe64489be376e4010

Analysis

max time kernel
26s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 08:00

Target

6c45b638473370ff683c53d0258f2c234304bbf8a458d8cfe64489be376e4010.exe
Size

320KB
MD5

0d8f5099739aba3e89442d5db66cbcb0
SHA1

9c479f1f73c5dd15f602e8819c100fb20aea8c9f
SHA256

6c45b638473370ff683c53d0258f2c234304bbf8a458d8cfe64489be376e4010
SHA512

3725f1cd376b96564857859e3183620932b69d2cead79665d34cdd07c4a4f089d4a8b83d34f471cf818e0ab97a2fabc339562bec634ed87a829a7ccaa47e079b
SSDEEP

6144:LBk2+39vx2+exH2RfS155ONNXBuWoJBO9OMbHLkAqF7Ief9UmM7/uT:LBVctx2x52EB0NxDIBuOFe7/uT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1980	1784	WerFault.exe	6

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 1980	1784	6c45b638473370ff683c53d0258f2c234304bbf8a458d8cfe64489be376e4010.exe	28
PID 1784 wrote to memory of 1980	1784	6c45b638473370ff683c53d0258f2c234304bbf8a458d8cfe64489be376e4010.exe	28
PID 1784 wrote to memory of 1980	1784	6c45b638473370ff683c53d0258f2c234304bbf8a458d8cfe64489be376e4010.exe	28
PID 1784 wrote to memory of 1980	1784	6c45b638473370ff683c53d0258f2c234304bbf8a458d8cfe64489be376e4010.exe	28

C:\Users\Admin\AppData\Local\Temp\6c45b638473370ff683c53d0258f2c234304bbf8a458d8cfe64489be376e4010.exe
"C:\Users\Admin\AppData\Local\Temp\6c45b638473370ff683c53d0258f2c234304bbf8a458d8cfe64489be376e4010.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 36
  2⤵
  - Program crash
  PID:1980

memory/1784-55-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download