6fcdaf3c9184422c98f8f3da545624a48f394bacbe0018b01939d8aa6224e0ed

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 08:46

Target

6fcdaf3c9184422c98f8f3da545624a48f394bacbe0018b01939d8aa6224e0ed.exe
Size

225KB
MD5

09aace9f6e7a229a787b8c21ff1abb41
SHA1

5eb23aa3186374fe0e926af175dd67f4f82850d7
SHA256

6fcdaf3c9184422c98f8f3da545624a48f394bacbe0018b01939d8aa6224e0ed
SHA512

fd2b513a9f3644f0d819c3c449039330408691838a72d7327848c1e79fb7a088d398cf47d4e648cd40d776a7311842cafb26acf0210c6b98e577977e4a3006b5
SSDEEP

3072:hg0SFQcpHEHjhwOLjQXOy4fNbGTnm2AvtqfmzB9BEvPtbEAr7jZjgNwJN:rcpujWOLjq6fNbVvtKmzBjEvPuAr71jb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1104	2040	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1104	2040	6fcdaf3c9184422c98f8f3da545624a48f394bacbe0018b01939d8aa6224e0ed.exe	28
PID 2040 wrote to memory of 1104	2040	6fcdaf3c9184422c98f8f3da545624a48f394bacbe0018b01939d8aa6224e0ed.exe	28
PID 2040 wrote to memory of 1104	2040	6fcdaf3c9184422c98f8f3da545624a48f394bacbe0018b01939d8aa6224e0ed.exe	28
PID 2040 wrote to memory of 1104	2040	6fcdaf3c9184422c98f8f3da545624a48f394bacbe0018b01939d8aa6224e0ed.exe	28

C:\Users\Admin\AppData\Local\Temp\6fcdaf3c9184422c98f8f3da545624a48f394bacbe0018b01939d8aa6224e0ed.exe
"C:\Users\Admin\AppData\Local\Temp\6fcdaf3c9184422c98f8f3da545624a48f394bacbe0018b01939d8aa6224e0ed.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 88
  2⤵
  - Program crash
  PID:1104

memory/2040-55-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download