b6d47df2612e12bff32c76f9fb6807bfae1e49061350a6a08eade537e23e8ab2

Analysis

max time kernel
38s
max time network
123s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 21:58

Target

b6d47df2612e12bff32c76f9fb6807bfae1e49061350a6a08eade537e23e8ab2.exe
Size

119KB
MD5

ab6d3ffe6d2a06a24e734be2055e1d40
SHA1

3550c68ecec5da7d4ffad83320d065a2ea9dee98
SHA256

b6d47df2612e12bff32c76f9fb6807bfae1e49061350a6a08eade537e23e8ab2
SHA512

94a9c7742b070c37de8c8494c7f8d2e3b0f0a895b953910052ef9ac79b6ff84736de4b0b1a67daa1c7638440b4528214636c194eaf71834a01f7b9d359ad4b21
SSDEEP

1536:8ao4PDAVPwYBm7UvQbxLSMtE1PKUWIpjVrs2ryrd1vUQuqSSqK5tnCvv:8ahU5wYQCQb8WuKUWIHs2qxnC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
516	1504	WerFault.exe	18

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 516	1504	b6d47df2612e12bff32c76f9fb6807bfae1e49061350a6a08eade537e23e8ab2.exe	28
PID 1504 wrote to memory of 516	1504	b6d47df2612e12bff32c76f9fb6807bfae1e49061350a6a08eade537e23e8ab2.exe	28
PID 1504 wrote to memory of 516	1504	b6d47df2612e12bff32c76f9fb6807bfae1e49061350a6a08eade537e23e8ab2.exe	28
PID 1504 wrote to memory of 516	1504	b6d47df2612e12bff32c76f9fb6807bfae1e49061350a6a08eade537e23e8ab2.exe	28

C:\Users\Admin\AppData\Local\Temp\b6d47df2612e12bff32c76f9fb6807bfae1e49061350a6a08eade537e23e8ab2.exe
"C:\Users\Admin\AppData\Local\Temp\b6d47df2612e12bff32c76f9fb6807bfae1e49061350a6a08eade537e23e8ab2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 36
  2⤵
  - Program crash
  PID:516

memory/1504-55-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download