6ff8faaf7bfa560c31a77afc54b35b59b439b72ad572be2528ff5a36f0f7a39e

Analysis

max time kernel
34s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 00:36

Target

6ff8faaf7bfa560c31a77afc54b35b59b439b72ad572be2528ff5a36f0f7a39e.exe
Size

411KB
MD5

1fb8ff8ba1e5745d1c9554d0c3221f00
SHA1

5258fc2f6f51517b938ae5d0a860f8c252720a37
SHA256

6ff8faaf7bfa560c31a77afc54b35b59b439b72ad572be2528ff5a36f0f7a39e
SHA512

0f66c901314612787f3e206e232196c46e55ec5b123851cf080d5fce14331432649c1c2c850a40e3941516649a6e502eebee7ec9b2ca8489b8f87cbd79e05a06
SSDEEP

6144:7EhIX2kQTcWj2XwvRFWM9rppV065gS2LXqEneJOMEMs7L9OaNa+dkE7+J1Zb5r:7EhIXPQQWVzWMljuS2CbYI9r

Score

5^/10

Drops file in System32 directory 1 IoCs

Processes:

6ff8faaf7bfa560c31a77afc54b35b59b439b72ad572be2528ff5a36f0f7a39e.exe

description	ioc	process
File opened for modification	C:\Windows\System32\LogFiles\Dwm\{msdt-9er-45fr-gthb89}_4595.log	6ff8faaf7bfa560c31a77afc54b35b59b439b72ad572be2528ff5a36f0f7a39e.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1360 1016 WerFault.exe 6ff8faaf7bfa560c31a77afc54b35b59b439b72ad572be2528ff5a36f0f7a39e.exe

pid	pid_target	process	target process
1360	1016	WerFault.exe	6ff8faaf7bfa560c31a77afc54b35b59b439b72ad572be2528ff5a36f0f7a39e.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6ff8faaf7bfa560c31a77afc54b35b59b439b72ad572be2528ff5a36f0f7a39e.exe

description	pid	process	target process
PID 1016 wrote to memory of 1360	1016	6ff8faaf7bfa560c31a77afc54b35b59b439b72ad572be2528ff5a36f0f7a39e.exe	WerFault.exe
PID 1016 wrote to memory of 1360	1016	6ff8faaf7bfa560c31a77afc54b35b59b439b72ad572be2528ff5a36f0f7a39e.exe	WerFault.exe
PID 1016 wrote to memory of 1360	1016	6ff8faaf7bfa560c31a77afc54b35b59b439b72ad572be2528ff5a36f0f7a39e.exe	WerFault.exe
PID 1016 wrote to memory of 1360	1016	6ff8faaf7bfa560c31a77afc54b35b59b439b72ad572be2528ff5a36f0f7a39e.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 136
2⤵
- Program crash
PID:1360