6c3b29c74aa67604a649270ab7f578bf09b9c8c5a1fd413bc17e2ef340dcd0bd

Analysis

max time kernel
84s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:15

Target

6c3b29c74aa67604a649270ab7f578bf09b9c8c5a1fd413bc17e2ef340dcd0bd.exe
Size

475KB
MD5

5ee238c63aef5bc210dec4d329f5bd80
SHA1

d516751f5456a700e343eb0e78715e6943cbaf77
SHA256

6c3b29c74aa67604a649270ab7f578bf09b9c8c5a1fd413bc17e2ef340dcd0bd
SHA512

883a259ff5a79dc05319b4b3fff0d4344d2b635d057b9b2c1f0cea6761d35256a74432d97f5b2b7fdd7c15bfae95776cd177bb09b8c259ec854e1bc0da48191a
SSDEEP

6144:YoLY3VafUTGekL7sHVn+ZZGzLI2hXWaBn4GgmRhXjxS6fgALAo4pg+dFu121GvF3:cMU/kviV+WzE2lBFr5zpN1Z6q

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1028 1968 WerFault.exe 6c3b29c74aa67604a649270ab7f578bf09b9c8c5a1fd413bc17e2ef340dcd0bd.exe

pid	pid_target	process	target process
1028	1968	WerFault.exe	6c3b29c74aa67604a649270ab7f578bf09b9c8c5a1fd413bc17e2ef340dcd0bd.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

6c3b29c74aa67604a649270ab7f578bf09b9c8c5a1fd413bc17e2ef340dcd0bd.exe

description	pid	process	target process
PID 1968 wrote to memory of 1028	1968	6c3b29c74aa67604a649270ab7f578bf09b9c8c5a1fd413bc17e2ef340dcd0bd.exe	WerFault.exe
PID 1968 wrote to memory of 1028	1968	6c3b29c74aa67604a649270ab7f578bf09b9c8c5a1fd413bc17e2ef340dcd0bd.exe	WerFault.exe
PID 1968 wrote to memory of 1028	1968	6c3b29c74aa67604a649270ab7f578bf09b9c8c5a1fd413bc17e2ef340dcd0bd.exe	WerFault.exe
PID 1968 wrote to memory of 1028	1968	6c3b29c74aa67604a649270ab7f578bf09b9c8c5a1fd413bc17e2ef340dcd0bd.exe	WerFault.exe
PID 1968 wrote to memory of 1028	1968	6c3b29c74aa67604a649270ab7f578bf09b9c8c5a1fd413bc17e2ef340dcd0bd.exe	WerFault.exe
PID 1968 wrote to memory of 1028	1968	6c3b29c74aa67604a649270ab7f578bf09b9c8c5a1fd413bc17e2ef340dcd0bd.exe	WerFault.exe
PID 1968 wrote to memory of 1028	1968	6c3b29c74aa67604a649270ab7f578bf09b9c8c5a1fd413bc17e2ef340dcd0bd.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\6c3b29c74aa67604a649270ab7f578bf09b9c8c5a1fd413bc17e2ef340dcd0bd.exe
"C:\Users\Admin\AppData\Local\Temp\6c3b29c74aa67604a649270ab7f578bf09b9c8c5a1fd413bc17e2ef340dcd0bd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 256
2⤵
- Program crash
PID:1028

memory/1028-55-0x0000000000000000-mapping.dmp

Download
memory/1968-54-0x0000000075671000-0x0000000075673000-memory.dmp

Filesize
8KB

Download
memory/1968-56-0x0000000030000000-0x00000000300BF000-memory.dmp

Filesize
764KB

Download
memory/1968-57-0x0000000000230000-0x00000000002EF000-memory.dmp

Filesize
764KB

Download