6fbc01280cc13a7a2b3d87b46fb7f15dc5f066a0cc8544ccad8a25b2b84af1bc

Analysis

max time kernel
25s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:18

Target

6fbc01280cc13a7a2b3d87b46fb7f15dc5f066a0cc8544ccad8a25b2b84af1bc.exe
Size

87KB
MD5

fc096c2e5c82684537687ae03024ae6a
SHA1

1e221263fd97c0aeba6039927cea629cad8bf21d
SHA256

6fbc01280cc13a7a2b3d87b46fb7f15dc5f066a0cc8544ccad8a25b2b84af1bc
SHA512

d94d7dc07b7c292cf2701905ffb896fd1490a76824391640704c90fee795c0784ad6412472eedd8ab290d4dba1a706f126c6e96222e5569bdabdbb326165484b
SSDEEP

1536:+3xJcZN65XKtkGyJQ+rqLpsyB5ZbOZQav1UKb0QTnhespjVrs2ryrd1vUQuq079c:+3Ij65+kGyJFrqLGyLZbOZXv1UKb0cnS

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2036 948 WerFault.exe 6fbc01280cc13a7a2b3d87b46fb7f15dc5f066a0cc8544ccad8a25b2b84af1bc.exe

pid	pid_target	process	target process
2036	948	WerFault.exe	6fbc01280cc13a7a2b3d87b46fb7f15dc5f066a0cc8544ccad8a25b2b84af1bc.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6fbc01280cc13a7a2b3d87b46fb7f15dc5f066a0cc8544ccad8a25b2b84af1bc.exe

description	pid	process	target process
PID 948 wrote to memory of 2036	948	6fbc01280cc13a7a2b3d87b46fb7f15dc5f066a0cc8544ccad8a25b2b84af1bc.exe	WerFault.exe
PID 948 wrote to memory of 2036	948	6fbc01280cc13a7a2b3d87b46fb7f15dc5f066a0cc8544ccad8a25b2b84af1bc.exe	WerFault.exe
PID 948 wrote to memory of 2036	948	6fbc01280cc13a7a2b3d87b46fb7f15dc5f066a0cc8544ccad8a25b2b84af1bc.exe	WerFault.exe
PID 948 wrote to memory of 2036	948	6fbc01280cc13a7a2b3d87b46fb7f15dc5f066a0cc8544ccad8a25b2b84af1bc.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\6fbc01280cc13a7a2b3d87b46fb7f15dc5f066a0cc8544ccad8a25b2b84af1bc.exe
"C:\Users\Admin\AppData\Local\Temp\6fbc01280cc13a7a2b3d87b46fb7f15dc5f066a0cc8544ccad8a25b2b84af1bc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 36
  2⤵
  - Program crash
  PID:2036

memory/948-55-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2036-54-0x0000000000000000-mapping.dmp

Download